EUVD-2026-88625
GHSA-cc3x-v8vh-qhvv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Rebuild /user/login endpoint
-
ExploitSend crafted authentication request
-
ExecutionTrigger improper authentication logic
-
ImpactObtain unauthorized limited access to application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable remotely against the /user/login endpoint of Rebuild instances up to 4.4.7 and 4.5.0-beta5 with no authentication, no user interaction, and low complexity (AV:N/AC:L/PR:N/UI:N) - i.e., any internet- or network-exposed Rebuild login page in the default configuration is reachable. Limiting factors: the vendor rates all impacts as Low, so successful exploitation appears to grant only partial access rather than full account/admin takeover; there is no vendor patch available (vendor non-responsive), and the precise triggering input is only documented in the referenced public POC. Realistic risk is bounded by how exposed the instance is and by the limited impact scope. |
| Impact | This is a moderate-risk issue that should be triaged above baseline but is not a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw against a login endpoint, which is intrinsically exposure-relevant. However, the vendor-assigned impact is uniformly Low (VC:L/VI:L/VA:L), yielding only 6.9, which is inconsistent with a full authentication bypass - a true login bypass on a CRM/ERP platform would normally warrant High confidentiality/integrity impact. This suggests the 'improper authentication' weakness produces only partial/limited access rather than complete account takeover, OR the impact is under-characterized because VulDB scored a vague submission. A public exploit exists (E:P in vector, referenced GitHub issue), which raises practical risk, but EPSS is not provided and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals. Key limitation: the description is generic ('an unknown part of the file /user/login... leads to improper authentication'), so the precise mechanism and true impact cannot be confirmed from the input and should be validated against the referenced POC and vendor code. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to the Rebuild /user/login endpoint to abuse the improper authentication logic and gain unauthorized (though vendor-rated limited) access to the application. A public proof-of-concept is referenced on GitHub (ASantsSec/CVE issue #25), lowering the effort required. The low attack complexity and lack of required privileges or user interaction mean the attempt can be automated against internet-exposed instances. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Rebuild instances up to and including 4.4.7 and 4.5.0-beta5 expose a login endpoint (/user/login) that fails to properly validate authentication, allowing unauthenticated remote attackers to bypass the intended login control (CWE-287). Exploitation requires no credentials, no user interaction, and low complexity (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), so any internet- or network-reachable Rebuild login page in its default configuration is a viable target. Publicly available exploit code exists and the vulnerability is documented by VulDB with a linked GitHub POC, but it has not been confirmed as actively exploited (not in CISA KEV); all impacts are rated Low, so successful abuse appears to yield partial access rather than full administrative takeover. The vendor was contacted but did not respond, and no vendor-released patch has been identified, making exposure reduction the primary near-term defense.
RemediationAI
No vendor-released patch has been identified at the time of analysis; the vendor was contacted about this disclosure and did not respond in any way, so there is currently no fixed version to upgrade to for either the 4.4.x line or the 4.5.0-beta5 branch. Because the flaw lives in the /user/login authentication flow, the most effective compensating control is to stop untrusted parties from reaching that endpoint: place the Rebuild instance behind a reverse proxy or WAF that restricts both the root login page and /user/login to known source IP ranges or to an authenticated access layer (VPN, mTLS, or SSO gateway), accepting the trade-off that this prevents legitimate remote users from logging in directly unless they traverse that layer. Additional hardening includes disabling public exposure of the login endpoint where an alternate internal access path exists, enabling rate limiting and alerting on anomalous login patterns, and closely monitoring authentication and session logs for sign-ins that lack a corresponding credential exchange, since an improper-authentication bypass can leave little trace in normal application logs. Organizations unable to remove network exposure should treat Rebuild accounts as potentially reachable without credentials, avoid storing sensitive data in the instance, and monitor the VulDB advisory pages (https://vuldb.com/vuln/411150 and https://vuldb.com/cve/CVE-2026-102248) plus https://github.com/ASantsSec/CVE/issues/25 for the public POC details and any future vendor fix, applying it immediately once available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-287 (Improper Authentication) and resides in the Login Endpoint component, specifically the /user/login handler of Rebuild. Rebuild is a web application, so the vulnerable surface is an HTTP-facing authentication routine that reaches a flawed state decision - for example, treating a malformed, partial, or otherwise unverifiable login request as a successful authentication, or failing to bind a session to a properly validated identity. The supplied CPE data (cpe:2.3:a:n/a:rebuild:*:*:*:*:*:*:*:*) is unfixed and vendor-anonymous, meaning the version ranges must be taken from the advisory text rather than a normalized CPE: all releases up to 4.4.7 plus the 4.5.0-beta5 pre-release branch are affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) confirms the attack is network-delivered, needs no privileges or user interaction, and is proven-exploitable per the Exploit Maturity metric, while the Low CIA values indicate the flaw does not hand over wholesale control of the application. The root cause class - authentication logic that accepts input it should reject - typically stems from missing identity verification, trust of client-supplied session or role data, or an incorrect branch/return value in the credential check.
Know when Rebuild gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Login endpoint reachable remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impacts kept Low across C/I/A to mirror the vendor's limited-access characterization rather than a full bypass.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Rated critical severity (CVSS
A vulnerability, which was classified as critical, was found in Rebuild up to 3.2.3. Rated critical severity (CVSS 9.8),
A vulnerability, which was classified as critical, has been found in Rebuild up to 3.2.3. Rated critical severity (CVSS
A vulnerability classified as critical was found in Rebuild up to 3.2.3. Rated high severity (CVSS 8.8), this vulnerabil
A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic.getStorageFile of the file /filex/proxy-d
A Server-Side Request Forgery (SSRF) in Rebuild v2.8.3 allows attackers to obtain the real IP address and scan Intranet
A vulnerability classified as problematic was found in Rebuild up to 3.5.5. Rated medium severity (CVSS 6.1), this vulne
Missing authorization in REBUILD up to 4.4.11 allows unauthenticated remote attackers to manipulate the url or fileKey p
A vulnerability was found in Rebuild up to 3.5.5. Rated medium severity (CVSS 5.4), this vulnerability is remotely explo
A vulnerability, which was classified as problematic, was found in ruifang-tech Rebuild 3.8.5. Rated medium severity (CV
A vulnerability, which was classified as problematic, has been found in ruifang-tech Rebuild 3.8.5. Rated medium severit
An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via t
Exploit-DB