What is the CVSS score of CVE-2026-27012?

CVE-2026-27012 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-27012?

Yes, a public proof-of-concept exploit is available for CVE-2026-27012. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27012?

Within 24 hours: Identify all systems running OpenSTAManager and isolate them from production networks if possible; enable enhanced logging and monitoring for exploitation attempts. Within 7 days: Implement network segmentation to restrict OpenSTAManager access to authorized users only; deploy WAF rules to block known exploit patterns; evaluate alternative software solutions. Within 30 days: Complete migration to a patched version or alternative platform; conduct forensic analysis for signs of compromise; implement network-based intrusion detection signatures.

Openstamanager CVE-2026-27012

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-03-03 security-advisories@github.com

GHSA-247v-7cw6-q57v

PHP Authentication Bypass Privilege Escalation Openstamanager Devcode

9.8

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Discover modules/utenti/actions.php endpoint
Exploit

Send POST request with idgruppo parameter
Execution

Modify user group assignment
Impact

Escalate privileges to Amministratori

Vulnerability Assessment

Weakness	CWE CWE-306 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Authentication required for critical functions MITRE ATT&CK 1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	OpenSTAManager version 2.9.8 or earlier with modules/utenti/actions.php accessible without authentication. No special configuration required — remote unauthenticated exploitation against default installations.
Impact	CVSS 9.8.
Exploit ScenarioDerived	Bypass auth and escalate privileges.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Privilege escalation and auth bypass in OpenSTAManager 2.9.8. PoC available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:05 CVSS 9.8

Auth bypass in OpenSTAManager.

RemediationAI

Update.

Affected Packages

composer devcode-it/openstamanager no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in composer

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-306.

Know when Openstamanager gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 05, 2026 - 18:19 vuln.today

Public exploit code

CVE Published

Mar 03, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a privilege escalation and authentication bypass vulnerability in OpenSTAManager allows any attacker to arbitrarily change a user's group (idgruppo) by directly calling modules/utenti/actions.php. This can promote an existing account (e.g. agent) into the Amministratori group as well as demote any user including existing administrators.

Executive ViewAI

Why It Matters

A critical vulnerability (CVSS 9.8) in OpenSTAManager allows remote attackers to achieve complete system compromise with a publicly available exploit and no vendor patch currently available. Organizations running this software face immediate risk of data theft, service disruption, and potential operational shutdown.

Business Impact: Severe

Compensating Controls

Implement network segmentation restricting OpenSTAManager access; deploy Web Application Firewall (WAF) rules targeting exploitation vectors; disable non-essential features and interfaces; enforce strict authentication and IP whitelisting; implement real-time log monitoring and alerting; consider air-gapping the application or running in isolated sandbox environment; evaluate immediate migration to alternative invoicing and technical assistance software.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.