What is the CVSS score of CVE-2026-31839?

CVE-2026-31839 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Striae are affected by CVE-2026-31839?

A high-severity integrity bypass vulnerability in Striae (v<3.0.0) compromises the reliability of digital confirmations in firearms examination workflows, potentially invalidating forensic evidence…. A patch is available.

How to fix or mitigate CVE-2026-31839?

Within 24 hours: Identify all systems running Striae versions prior to 3.0.0 and assess current usage in active cases. Within 7 days: Implement manual verification procedures for all digital confirmations generated by affected systems; document workarounds and notify legal/compliance teams of potential evidence integrity concerns. Within 30 days: Upgrade to Striae v3.0.0 or later, validate patch deployment, retrain users on updated workflow, and conduct retrospective review of critical cases processed during vulnerable period.

Striae CVE-2026-31839

Q: How to fix or mitigate CVE-2026-31839?

Within 24 hours: Identify all systems running Striae versions prior to 3.0.0 and assess current usage in active cases. Within 7 days: Implement manual verification procedures for all digital confirmations generated by affected systems; document workarounds and notify legal/compliance teams of potential evidence integrity concerns. Within 30 days: Upgrade to Striae v3.0.0 or later, validate patch deployment, retrain users on updated workflow, and conduct retrospective review of critical cases processed during vulnerable period.

HIGH

Improper Validation of Integrity Check Value (CWE-354)

2026-03-11 security-advisories@github.com

GHSA-mmf8-487q-p45m

Authentication Bypass Striae

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

HIGH 8.2

DescriptionGitHub Advisory

Striae is a firearms examiner's comparison companion. A high-severity integrity bypass vulnerability existed in Striae's digital confirmation workflow prior to v3.0.0. Hash-only validation trusted manifest hash fields that could be modified together with package content, allowing tampered confirmation packages to pass integrity checks. This vulnerability is fixed in 3.0.0.

AnalysisAI

Striae versions prior to 3.0.0 allow local attackers to bypass package integrity verification by modifying both the manifest hash and package contents simultaneously, enabling delivery of tampered firearm examination data that passes validation checks. This integrity bypass affects forensic workflows relying on Striae's digital confirmation mechanism. No patch is currently available for affected installations.