Pingvin Share X CVE-2026-49467

Exploitation requires a valid authenticated user account on the target Pingvin Share X instance (PR:L per CVSS vector). The attacker must be able to reach the TOTP management API endpoint over the network (AV:N). No special configuration is required beyond TOTP being available as a feature, which is part of the standard deployment. No user interaction from any other party is needed. Exploitation is limited by the authentication prerequisite - unauthenticated attackers cannot exploit this directly - and by the fact that impact is scoped to the authenticated user's own account (S:U), unless the attacker can leverage TOTP state manipulation to gain escalated access through other means.

The NVD CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects network accessibility and low-complexity exploitation but warrants nuance. PR:L confirms exploitation requires a valid user account on the target instance - this is not an unauthenticated attack. The high Integrity and Confidentiality ratings are justified because disabling TOTP can cascade into full account compromise if attackers control their own session or target shared administration patterns. The A:H rating in the vendor vector is arguable; the primary harm is integrity loss (disabling 2FA), with availability impact being secondary and limited. No EPSS data was provided, and there is no CISA KEV listing and no known public POC, which meaningfully reduces the urgency for non-internet-facing self-hosted deployments. For instances exposed to the internet with multiple users, this is a genuine priority because any authenticated user can silently strip 2FA from their account or exploit admin-reset procedures. For private single-user instances, risk is much lower.

An attacker registers or already holds a valid low-privileged account on a Pingvin Share X instance. They navigate to the TOTP settings management endpoint and submit a request to disable or modify TOTP with an arbitrary incorrect password. Because the server-side password check evaluates an unawaited Promise (always truthy), the guard condition never fires, and TOTP is silently disabled on the account - removing the 2FA barrier for subsequent logins. No exploit code or special tooling is required beyond a standard HTTP client.