N A CVE-2026-30521

While CVSS metrics are unavailable, the risk is significant within organizational context despite moderate technical barriers. The attack requires administrative authentication (PR:H), which limits the threat actor pool to trusted insiders or those who have compromised administrative accounts; this is a critical assumption that affects real-world severity. The attack vector is network-based (AV:N) and requires no special complexity once authentication is obtained. The SSVC framework indicates: exploitation status is confirmed (publicly available proof-of-concept), automatable (simple HTTP request manipulation), and technical impact is moderate (financial data integrity loss, potential system confusion on negative interest calculations). However, this is not a critical remote code execution or data breach vector-it is a business logic error that corrupts data quality. Real-world priority depends on whether the organization's loan calculation engine properly handles negative values downstream; if calculations assume positive rates, this could cause incorrect billing, system crashes, or financial misstatement. The public availability of exploit code increases likelihood of discovery by malicious insiders but does not increase the attack surface beyond authenticated administrators.

An authenticated administrator (or an attacker who has obtained administrator credentials through social engineering or credential theft) accesses the loan plan creation interface. Instead of using the web browser form, the attacker intercepts or crafts a direct HTTP POST request to the backend API endpoint, setting interest_percentage to a negative value (e.g., -5.0). The server accepts and stores this loan plan in the database. When loans are issued under this plan, the negative interest rate may cause the system to credit borrowers money instead of charging interest, resulting in financial loss or system malfunction. A proof-of-concept demonstrating this technique is publicly available on GitHub, making the attack easily reproducible.