Which versions of Wakyma Application Web are affected by CVE-2026-3020?

CVE-2026-3020 is a critical identity-based authorization bypass that enables attackers to hijack legitimate user accounts by modifying email addresses and resetting passwords.. A patch is available.

How to fix or mitigate CVE-2026-3020?

Within 24 hours: Inventory all affected systems and assess current exposure; notify security operations to monitor for exploitation attempts. Within 7 days: Apply vendor patch to all production systems; validate patch deployment across infrastructure. Within 30 days: Conduct post-patch audit of account modifications and password resets; review access logs for suspicious account recovery activities during the vulnerability window.

Wakyma Application Web CVE-2026-3020

Q: What is the CVSS score of CVE-2026-3020?

CVE-2026-3020 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12389 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-16 INCIBE

Authentication Bypass Wakyma Application Web

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 11:00 euvd

EUVD-2026-12389

Analysis Generated

Mar 16, 2026 - 11:00 vuln.today

Patch released

Mar 16, 2026 - 11:00 nvd

Patch available

CVE Published

Mar 16, 2026 - 10:09 nvd

HIGH 8.6

DescriptionCVE.org

Identity based authorization bypass vulnerability (IDOR) that allows an attacker to modify the data of a legitimate user account, such as changing the victim's email address, validating the new email address, and requesting a new password. This could allow them to take complete control of other users' legitimate accounts

AnalysisAI

An identity-based authorization bypass vulnerability (IDOR) allows authenticated attackers to modify other users' account data, including email addresses, and subsequently hijack accounts through password reset flows. The vulnerability affects an unspecified product with a CVSS 8.6 severity rating, requires only low privileges to exploit over the network, and enables complete account takeover. No active exploitation has been reported (not in KEV), no public proof-of-concept exists, and the EPSS score is unavailable.

Technical ContextAI

This vulnerability represents an Insecure Direct Object Reference (IDOR) flaw, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to properly verify that authenticated users can only access or modify their own account data. The vulnerability allows attackers to manipulate object references (likely user IDs or account identifiers) to access and modify other users' profiles. No specific CPE strings or affected products are identified in the available intelligence, suggesting this may be a placeholder CVE or the affected vendor has not been disclosed.

RemediationAI

Without identified affected products or vendor advisories, specific patching guidance cannot be provided for CVE-2026-3020. Organizations should implement general IDOR prevention controls including proper authorization checks that validate user permissions before allowing profile modifications, implementing secure session management, and adding rate limiting on sensitive account operations. Monitor authentication logs for suspicious account modification patterns and consider implementing additional verification steps for email changes and password resets.