Which versions of mpGabinet are affected by CVE-2026-40551?

CVE-2026-40551 affects mpGabinet 23.12.19 and earlier, enabling authenticated local users to bypass authentication controls and assume administrative privileges by modifying application binaries.

How to fix or mitigate CVE-2026-40551?

Within 24 hours: Identify all systems running mpGabinet versions 23.12.19 and earlier via inventory/asset management tools. Within 7 days: Restrict file system write permissions on mpGabinet installation directories and implement application integrity monitoring (code signing verification, binary hash monitoring). Within 30 days: Upgrade to mpGabinet 23.12.20 or later (confirm vendor advisory for patched version), or migrate to alternative solution if upgrade unavailable.

mpGabinet CVE-2026-40551

Q: What is the CVSS score of CVE-2026-40551?

CVE-2026-40551 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26045 HIGH

Use of Client-Side Authentication (CWE-603)

2026-04-28 CERT-PL

Authentication Bypass Mpgabinet

8.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:23 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 14:30 vuln.today

CVSS changed

Apr 28, 2026 - 14:22 NVD

8.4 (HIGH)

EUVD ID Assigned

Apr 28, 2026 - 14:00 euvd

EUVD-2026-26045

Analysis Generated

Apr 28, 2026 - 14:00 vuln.today

CVE Published

Apr 28, 2026 - 13:13 nvd

HIGH 8.4

DescriptionCVE.org

mpGabinet performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary user.

This issue affects mpGabinet version 23.12.19 and below.

AnalysisAI

Client-side authentication bypass in mpGabinet 23.12.19 and earlier allows local authenticated attackers to impersonate arbitrary users by patching the application binary. An attacker with legitimate low-privilege access to the system can manipulate the compiled application code to skip login verification entirely, gaining unauthorized access as any user including administrators. EPSS score not available for this 2026 CVE; no active exploitation or public POC confirmed at time of analysis.

Technical ContextAI

The vulnerability stems from CWE-603 (Use of Client-Side Authentication), a fundamental architectural flaw where security-critical authentication logic resides in the client application rather than being enforced server-side. In mpGabinet, the login verification process executes within the local application binary, making it susceptible to reverse engineering and binary patching. An attacker can use tools like hex editors, debuggers, or binary patchers to modify the compiled code-such as changing conditional jump instructions, NOP-ing out authentication checks, or hardcoding success values-to bypass the verification routine. Because the backend server trusts the client's assertion of authenticated status rather than independently validating credentials, the compromised client can present itself as any user. This design pattern violates the principle that clients are untrusted and all security enforcement must occur server-side. The CPE cpe:2.3:a:binsoft:mpgabinet identifies the vendor as Binsoft and confirms this is an application-layer vulnerability affecting all instances of the software.

RemediationAI

Upgrade to mpGabinet version later than 23.12.19 if a patched release is available-check the vendor website at https://www.mpgabinet.pl/ and the CERT-PL advisory at https://cert.pl/posts/2026/04/CVE-2026-40550/ for update announcements, though no specific fix version is confirmed in available data at time of analysis. Because this is an architectural vulnerability (CWE-603), effective remediation requires the vendor to redesign authentication to enforce all verification server-side rather than client-side. Until a patched version with server-enforced authentication is deployed, implement strict compensating controls: restrict local access to systems running mpGabinet to only fully trusted users through OS-level access controls and group policies; deploy application whitelisting or integrity monitoring solutions (Windows Defender Application Control, AppLocker, HIDS) to detect unauthorized binary modifications; implement file system permissions preventing non-administrative users from writing to the mpGabinet installation directory; enable audit logging for all mpGabinet authentication events and cross-reference with backend server logs to detect anomalies indicating bypassed authentication. Note that these mitigations only raise the bar for exploitation-they do not eliminate the underlying vulnerability. Organizations handling sensitive data should consider migrating to alternative solutions with server-enforced authentication if vendor patch timeline is uncertain.