EUVD-2026-52981
GHSA-x2cr-66mw-xj3j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
IDOR on ticket retrieval requires authenticated low-privilege session (PR:L); grants read/potential write to other users' ticket data (C:L/I:L); no availability impact from object-access bypass.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Authorization bypass in the TicketDetailView component of Ehco1996 django-sspanel allows authenticated remote users to access support tickets belonging to other users by manipulating a user-controlled key in requests to apps/sspanel/views.py. All releases through 2023.12.26 are affected per ENISA EUVD-2026-52981. No patch will be issued - the maintainer has abandoned the project and did not respond to disclosure - leaving operators with no vendor remediation path. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
CWE-639 (Authorization Bypass Through User-Controlled Key) is an IDOR-class flaw in which the application uses a caller-supplied identifier - typically a numeric primary key or slug - to retrieve an object without verifying the requesting user is authorized to access that specific object. In django-sspanel, the TicketDetailView function in apps/sspanel/views.py processes support ticket retrieval requests without enforcing object-level ownership checks, allowing any authenticated user to substitute another user's ticket identifier and receive the response. django-sspanel is a Django-based ShadowsocksR/proxy subscription management panel. The affected CPE is cpe:2.3:a:ehco1996:django-sspanel:*:*:*:*:*:*:*:*, covering all versions up to and including 2023.12.26.
RemediationAI
No vendor-released patch is available for CVE-2026-18818, and none is expected - the maintainer has declared django-sspanel unsupported and did not respond to the coordinated disclosure. The primary recommended action is migration to an actively maintained proxy panel alternative, eliminating exposure at its root. As an immediate compensating control, restrict network access to the django-sspanel instance using firewall rules or a reverse proxy with IP allowlisting, limiting who can obtain the authenticated session required to exploit the flaw; this reduces but does not eliminate risk from insider or stolen-credential scenarios. If the panel's support ticket feature is not in active use, disabling or removing the TicketDetailView route in the URL configuration eliminates the vulnerable code path entirely, at the cost of losing ticket functionality. Operators who cannot migrate immediately should audit ticket contents for sensitive data and rotate any credentials or user details that may have been exposed.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today