Which versions of PHP are affected by CVE-2026-4831?

Organizations using A security flaw should be aware of moderate risk from CVE-2026-4831, a improper authentication vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4831?

Yes, a public proof-of-concept exploit is available for CVE-2026-4831. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-4831?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

PHP CVE-2026-4831

Q: What is the CVSS score of CVE-2026-4831?

CVE-2026-4831 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-16076 LOW

Improper Authentication (CWE-287)

2026-03-26 VulDB

Authentication Bypass PHP

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.9 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 01:45 euvd

EUVD-2026-16076

Analysis Generated

Mar 26, 2026 - 01:45 vuln.today

CVE Published

Mar 26, 2026 - 01:02 nvd

MEDIUM 6.3

DescriptionCVE.org

A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the file /workspace/source-code/app/controller/explorer/auth.class.php of the component Password-protected Share Handler. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authentication in the password-protected share handler of Kalcaddle Kodbox 1.64 allows remote attackers to bypass access controls through manipulation of the authentication function, despite high attack complexity. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor.

Technical ContextAI

The vulnerability is classified as CWE-287 (Improper Authentication), a root cause weakness in authentication mechanisms. The affected component is Kalcaddle Kodbox (cpe:2.3:a:kalcaddle:kodbox), specifically the password-protected share handler functionality implemented in PHP. The vulnerable code exists in the 'can' function within the auth.class.php controller file, which is responsible for authentication validation when accessing password-protected file shares. The authentication bypass likely stems from inadequate validation of credentials or session state, allowing attackers to circumvent intended access controls without providing valid authentication material.

RemediationAI

Immediately upgrade Kalcaddle Kodbox to the latest available version beyond 1.64 once released; contact Kalcaddle directly for patching guidance given their previous non-responsiveness to disclosure. As an interim compensating control, administratively disable or restrict access to password-protected share functionality if it is not critical to operations. Alternatively, implement network-level access restrictions by placing Kodbox behind a reverse proxy that enforces additional authentication layers (such as LDAP, SAML, or OAuth) before allowing access to the share handler endpoints. Monitor access logs for unusual authentication patterns or repeated failed authentication attempts that may indicate exploitation attempts. Conduct a security audit of all existing password-protected shares to identify potentially compromised content and reset share passwords as a precautionary measure.