ZUS Płatnik CVE-2026-110972

Exploitation requires local access (AV:L) to an installed Płatnik application instance that is connected to the backend server; the input explicitly scopes the attacker as one 'with access to any application instance connected to the backend server.' Because authentication is performed client-side (CWE-603), an attacker who can run or manipulate such a connected client bypasses the login verification and authenticates as any user without credentials. The principal limiting factor is this local-access precondition: there is no indication the flaw is reachable remotely over the internet without first obtaining access to a deployed, backend-connected client, which materially narrows realistic exposure compared with a purely network-facing bypass.

The input assigns a CVSS 4.0 base score of 8.6 (High), driven by AV:L/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:L. This is a CWE-603 (use of client-side authentication) flaw: once an attacker has access to a backend-connected Płatnik instance, the bypass is trivial (AC:L) and requires no prior authentication (PR:N) - the login check itself is what is defeated. The key limiting signal is the LOCAL attack vector (AV:L): this is NOT remotely exploitable over the internet against an exposed service; the attacker must already have access to a deployed client connected to the backend. The vuln.today Decision label is 'this_week', indicating elevated but not emergency priority. No EPSS score is provided, there is no CISA KEV listing (expected - this is a Polish/ZUS product unlikely to appear in a US catalog), and no PoC or exploit reference is supplied. So the high score reflects genuine ease-of-exploitation and high impact once access is obtained, tempered by the local-access precondition and the absence of any evidence of active exploitation or public exploit code. This is a real, credible priority for organizations running Płatnik, but not a mass-remote-exploitation emergency; EPSS being absent means spread cannot be quantified from the input.

An attacker with access to a workstation running a Płatnik client that is connected to the organization's backend server manipulates the client-side login verification, authenticating as an arbitrary user without valid credentials. Having impersonated that user, the attacker can view and submit social-insurance documents on their behalf. No public exploit is identified at time of analysis.