Crafty Controller CVE-2026-5652

Requires authenticated access with high-privilege administrative credentials (PR:H from CVSS vector). The attacker must already possess valid admin-level credentials through compromise (phishing, credential stuffing, session hijacking) or be a malicious insider with legitimate administrative access. The Users API component must be network-accessible to the attacker (AV:N), which is default for web-based management platforms. No special configuration, non-default features, or user interaction required once authenticated. The vulnerability allows privilege escalation beyond intended administrative boundaries, meaning even legitimate high-privilege users can perform unauthorized modifications to other user accounts due to missing object-level authorization checks.

Real-world risk is moderate-to-high despite the 9.0 CVSS score. The CVSS vector shows network-accessible (AV:N) and low complexity (AC:L) attack, but critically requires high privileges (PR:H), meaning the attacker must already have administrative credentials. The scope change (S:C) drives the severity - indicating the vulnerability allows escape from the user management security boundary to affect other system components. No EPSS score provided, no CISA KEV listing, and no public exploit code suggests limited real-world exploitation to date. Primary risk scenarios involve compromised administrator accounts (phishing, credential theft) or malicious insiders with legitimate admin access. The authentication bypass tag indicates even high-privilege users can exceed their intended permissions, which is concerning for multi-admin environments. Organizations should prioritize this based on their administrative access controls and monitoring - not an immediate internet-wide threat like unauthenticated RCE, but a significant privilege escalation vector if administrative credentials are compromised. Missing data: EPSS probability, specific affected version range beyond the CPE wildcard, and patch availability status limit confidence in deployment urgency.

An attacker with compromised high-privilege administrative credentials authenticates to the Crafty Controller web interface and directly crafts API requests to the Users API endpoint, manipulating user ID parameters to modify accounts outside their intended scope. By exploiting the missing authorization validation (CWE-639), the attacker escalates their privileges, modifies other administrator accounts, injects backdoor accounts, or alters user permissions to gain persistent access across the Minecraft server management infrastructure.