Pachno CVE-2026-40043

Requires authenticated access to Pachno 1.0.6 with low-privilege user credentials. The vulnerable runSwitchUser() action must be accessible to standard users (not administratively disabled). Attackers need ability to manipulate HTTP cookies via browser tools or custom scripts. Default Pachno installations with user-switching functionality enabled meet these prerequisites.

Real-world risk is moderate despite the 7.1 CVSS score. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low complexity but requires prior authentication, limiting the attack surface to insider threats or scenarios where attackers have already compromised low-privilege accounts. EPSS exploitation probability is very low (0.07%, 22nd percentile), suggesting minimal attacker interest or detection in the wild. SSVC confirms proof-of-concept availability but marks the vulnerability as non-automatable, requiring human decision-making to execute effectively. The partial technical impact (VC:H/VI:N/VA:N) focuses on confidentiality breaches rather than system integrity or availability destruction. Organizations using Pachno should prioritize this based on deployment context: high-sensitivity environments with privileged data access warrant immediate patching, while isolated or low-trust deployments face lower urgency. No CISA KEV listing confirms this remains theoretical rather than actively weaponized.

An authenticated attacker with standard user credentials logs into Pachno 1.0.6 and modifies their browser's original_username cookie to an arbitrary value using developer tools. They then invoke the runSwitchUser() action with a request targeting user ID 1 (the default administrator account). Because the application fails to validate the cookie contents, Pachno grants a session token or exposes password hash material belonging to the administrator, allowing full takeover of privileged operations including system configuration changes, user management, and sensitive data access. SSVC confirms proof-of-concept code demonstrating this technique exists.