What is the CVSS score of CVE-2026-30760?

CVE-2026-30760 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of SourceBans Material Admin are affected by CVE-2026-30760?

SourceBans Material Admin before v1.1.6 allows unauthenticated remote attackers to arbitrarily modify user and administrative records through an unvalidated XAJAX interface, directly compromising the…

How to fix or mitigate CVE-2026-30760?

Within 24 hours: Identify all SourceBans Material Admin instances running versions prior to v1.1.6; move admin interface behind VPN access only or restrict to whitelisted internal IP ranges; implement network segmentation isolating the admin panel from untrusted networks. Within 7 days: Deploy WAF rules to enforce strict input validation on all XAJAX API requests; disable XAJAX endpoints if not operationally required; enable request logging and alerting on XAJAX calls with pattern-matching rules for data modification attempts. Within 30 days: Monitor vendor security advisories for v1.1.6+ patch availability; conduct security testing before deployment; execute full upgrade procedure and validate remediation through penetration testing of XAJAX endpoints.

SourceBans Material Admin CVE-2026-30760

HIGH

Improper Input Validation (CWE-20)

2026-05-28 mitre

Information Disclosure N A

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:27 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

7.3 (HIGH)

CVE Published

May 28, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a crafted XAJAX call.

AnalysisAI

Arbitrary user data manipulation in SourceBans Material Admin web application before v1.1.6 (commit 3ecd95e) allows remote unauthenticated attackers to alter other users' records by sending crafted XAJAX calls. The flaw stems from insufficient input validation (CWE-20) in the XAJAX request handler and is tagged as an Information Disclosure issue. No public exploit has been identified at time of analysis, and EPSS scores the likelihood of near-term exploitation at only 0.02% (5th percentile).

Technical ContextAI

SourceBans Material Admin is a community-maintained web frontend (forked from the SourceBans ban-management system) used by Source-engine game server administrators to manage player bans, comments, and admin accounts. The vulnerability sits in the application's use of XAJAX, a legacy PHP library that exposes server-side functions to the browser via asynchronous XML requests; XAJAX endpoints typically marshal client-supplied parameters into PHP function calls that mutate database state. CWE-20 (Improper Input Validation) here means the XAJAX-exposed handlers accept attacker-controlled identifiers or field values without verifying that the caller is authorized to modify the target record or that the supplied data conforms to expected types, enabling tampering with arbitrary user rows. The CPE entry returned by NVD is the placeholder 'cpe:2.3:a:n/a:n/a:*' rather than a vendor-specific string, reflecting that the project is community-maintained on GitHub (SB-MaterialAdmin/Web) rather than carrying an official vendor CPE.

RemediationAI

Upgrade SourceBans Material Admin to v1.1.6 or later (commit 3ecd95e), which the reporter identifies as the patched build - track the upstream repository at https://github.com/SB-MaterialAdmin/Web and review issue https://github.com/SB-MaterialAdmin/Web/issues/374 for the fix commit and any backport guidance. Because this is an upstream fix on a community project rather than a tagged vendor advisory, treat the fix as 'upstream patch available; released patched version confirmed by reporter as v1.1.6' and validate the commit hash before deploying. If you cannot upgrade immediately, restrict network access to the admin panel to trusted administrative IP ranges via reverse-proxy or firewall ACLs (trade-off: legitimate remote admins must use a VPN or jump host) and consider disabling or blocking the XAJAX endpoint path at the web server layer (trade-off: this will break any admin-panel features that rely on XAJAX-driven AJAX calls, including ban-management UI actions). Audit user, admin, and ban records for unexpected modifications since the vulnerable version was deployed.