Is there a public PoC exploit available for CVE-2026-18720?

Yes, a public proof-of-concept exploit is available for CVE-2026-18720. Prioritise patching immediately. EPSS: 0.3%.

KodBox CVE-2026-18720

Q: What is the CVSS score of CVE-2026-18720?

CVE-2026-18720 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-52565 MEDIUM

Improper Authorization (CWE-285)

2026-08-04 VulDB

GHSA-mv6j-rvc6-f296

PHP Authentication Bypass Kodbox Kalcaddle

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint with no user interaction; impact limited to low confidentiality, no integrity or availability effect confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 04, 2026 - 03:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 04, 2026 - 02:42 vuln.today

CVE Published

Aug 04, 2026 - 01:45 cve.org

MEDIUM 6.9

DescriptionCVE.org

A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the msgWarning plugin endpoint, resulting in limited unauthorized access to confidential data. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication is required, and a public proof-of-concept exploit has been published on GitHub. The vendor did not respond to responsible disclosure, leaving no confirmed patch available at time of analysis.

Technical ContextAI

KodBox is a PHP-based self-hosted file management and team collaboration platform developed by kalcaddle. The vulnerable component is the msgWarning plugin, exposed at the endpoint /index.php?plugin/msgWarning/action. CWE-285 (Improper Authorization) indicates the application fails to correctly enforce access control on this plugin action - either the authorization check is absent, circumventable, or incorrectly scoped - allowing requests that should be gated to pass through without valid credentials or session context. The PHP tag on the CVE and the plugin architecture suggest the flaw is likely a missing or bypassable middleware authorization gate specific to this plugin route. The CPE string cpe:2.3:a:kalcaddle:kodbox:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting NVD has not constrained the vulnerable range to a single release.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to the responsible disclosure attempt, so no fix version can be cited. For internet-exposed KodBox instances, the most actionable immediate control is to block or restrict external access to the specific endpoint /index.php?plugin/msgWarning/action via a web application firewall rule or reverse proxy ACL - this limits exposure without disabling the entire application, though it does not eliminate the underlying authorization flaw for internal users. Disabling the msgWarning plugin entirely, if the feature is non-essential to operations, is the next-most-effective compensating control. Placing KodBox behind VPN or IP allowlisting removes the network-accessible attack vector entirely (AV:N becomes moot) at the cost of remote usability. Monitor the GitHub PoC at https://github.com/sjmycz/cve/issues/4 and VulDB at https://vuldb.com/vuln/385631 for any vendor patch release. Consider migrating to an alternative platform if vendor responsiveness is a compliance requirement.