What is the CVSS score of CVE-2026-2174?

CVE-2026-2174 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Contact Management System are affected by CVE-2026-2174?

A HIGH severity vulnerability (CVE-2026-2174, CVSS 7.3) has been identified in Contact Management System 1.0 affecting CRUD endpoints with no available patch.

How to fix or mitigate CVE-2026-2174?

Within 24 hours: Inventory all systems running Contact Management System 1.0 and assess data sensitivity; isolate affected instances from production networks if feasible. Within 7 days: Implement compensating controls including network segmentation, WAF rules blocking suspicious CRUD requests, and enhanced logging/monitoring on affected endpoints. Within 30 days: Develop migration plan to alternative solution, contact vendor for patch timeline, and conduct full security assessment of affected systems.

Contact Management System CVE-2026-2174

HIGH

Improper Authentication (CWE-287)

2026-02-08 cna@vuldb.com

Authentication Bypass Contact Management System

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 08, 2026 - 19:16 nvd

HIGH 7.3

DescriptionCVE.org

A security flaw has been discovered in code-projects Contact Management System 1.0. This affects an unknown part of the component CRUD Endpoint. The manipulation of the argument ID results in improper authentication. The attack may be launched remotely.

AnalysisAI

Improper authentication in the CRUD endpoint of code-projects Contact Management System 1.0 allows unauthenticated remote attackers to manipulate ID parameters and bypass access controls. This vulnerability enables unauthorized users to read, modify, or delete sensitive contact data without valid credentials. No patch is currently available.

Technical ContextAI

Classified as CWE-287 (Improper Authentication). Affects Contact Management System. A security flaw has been discovered in code-projects Contact Management System 1.0. This affects an unknown part of the component CRUD Endpoint. The manipulation of the argument ID results in improper authentication. The attack may be launched remotely.