What is the CVSS score of CVE-2026-38807?

CVE-2026-38807 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of kvf-admin are affected by CVE-2026-38807?

kvf-admin v1.0.0 contains a privilege escalation vulnerability (CVSS 8.8) allowing authenticated users to elevate system permissions through authorization bypass in the UserController component;…

How to fix or mitigate CVE-2026-38807?

Within 24 hours: Inventory all kvf-admin v1.0.0 deployments and document exposed user populations; assess criticality of systems managed by kvf-admin. Within 7 days: Deploy compensating controls (enforce RBAC with privilege reviews, require MFA for all kvf-admin access, implement audit logging for privilege escalation attempts) and contact kvf-admin vendor regarding patch availability and timeline. Within 30 days: Execute migration to patched kvf-admin release (once vendor releases) or approved alternative admin platform; validate privilege levels post-migration.

kvf-admin CVE-2026-38807

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-27 cve@mitre.org

Java Authentication Bypass

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 16:22 vuln.today

CVSS changed

May 28, 2026 - 16:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

May 27, 2026 - 18:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component

AnalysisAI

Privilege escalation in kvf-admin v1.0.0 allows authenticated remote attackers to elevate their privileges by abusing insecure permission checks within the UserController.java component. The flaw maps to CWE-639 (Authorization Bypass Through User-Controlled Key), and while publicly available exploit code exists per the referenced GitHub issue, EPSS is very low (0.04%, 13th percentile), indicating limited observed exploitation activity. No CISA KEV listing exists, so this is not confirmed actively exploited.

Technical ContextAI

kvf-admin is a Java-based administrative backend framework (consistent with the 'Java' tag) that exposes user management functionality through Spring-style MVC controllers, specifically UserController.java. The underlying weakness is CWE-639, Authorization Bypass Through User-Controlled Key, meaning the controller trusts a user-supplied identifier (such as a userId or role parameter) when performing user operations without verifying that the requesting principal is authorized to act on that target object. Because the affected component handles user records, the missing object-level authorization check enables an authenticated low-privilege user to manipulate or assume the identity/role of higher-privileged accounts. No CPE strings were published in the intelligence provided, so affected component coverage is limited to the vendor's stated version 1.0.0.

Affected ProductsAI

The advisory names kvf-admin version 1.0.0 as affected, with the vulnerability located in the UserController.java component of the user management module. No CPE strings were published with this CVE, and no official vendor advisory URL is provided in the intelligence set; the only reference is a third-party proof-of-concept report at https://github.com/cagexunxi/CVE/issues/1, which should be reviewed for exact build identifiers. Later versions of kvf-admin are not explicitly confirmed vulnerable or fixed from the available data.

RemediationAI

No vendor-released patch identified at time of analysis - the only public reference is the researcher write-up at https://github.com/cagexunxi/CVE/issues/1, which should be monitored along with the upstream kvf-admin repository for a tagged 1.0.1+ release or commit addressing UserController.java authorization checks. In the interim, restrict network access to the kvf-admin management interface to trusted administrative networks or via VPN/zero-trust gateway (trade-off: blocks legitimate remote admins until allowlisted), tighten account provisioning so that low-privilege accounts cannot be created or self-registered (trade-off: may break onboarding workflows), and add a reverse-proxy or WAF rule that strips or rejects unexpected userId/role parameters on requests targeting the UserController endpoints (trade-off: may break legitimate admin actions that legitimately reference other users by ID, requiring per-endpoint tuning). Audit existing user and role tables for unauthorized privilege grants made prior to mitigation.