EUVD-2026-48714
GHSA-m6m7-rqhj-c4vv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low privileges
-
ExploitBrute-force numeric file IDs
-
ExecutionRequest attachment via download/view endpoint
-
ImpactAccess or manipulate files without ACL permission
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires authenticated access to sysPass with any user role. No specific configuration or feature must be enabled; the insecure direct object reference is inherently present in the default AccountFileController of all affected versions. The user does not need elevated privileges-any authenticated session can trigger the vulnerability. |
| Impact | The CVSS 4.0 score of 8.6 reflects high impact (VC:H/VI:H) but requires low privileges (PR:L). EPSS at 0.22% and 13th percentile indicates a low likelihood of exploitation, despite the public proof-of-concept. The SSVC assessment (exploitation: poc, automatable: no, technical impact: partial) aligns with this view. The vulnerability is serious once exploited, but the authentication requirement and low exploitation probability mean it is not an immediate emergency. Real-world risk is moderate, not critical, for most deployments. |
| Exploit ScenarioDerived | An attacker with low-privileged authenticated access enumerates numeric file IDs by iterating requests to the download or view endpoint. The attacker retrieves sensitive attachments (e.g., SSH keys, password lists) from accounts they are not authorized to access. Public proof-of-concept code demonstrates this exploitation technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Authenticated attackers can bypass access controls in sysPass 3.2.11 and earlier to access, download, or delete any account file attachment, regardless of their ACL permissions, by exploiting missing authorization checks in AccountFileController. Public exploit code is available, but the EPSS score of 0.22% indicates low likelihood of widespread exploitation.
RemediationAI
No vendor-released patch has been identified at the time of analysis. As a workaround, restrict access to the AccountFileController endpoints using a Web Application Firewall rule that blocks direct requests to /accountFile/ paths for unprivileged users, or disable the file attachment feature entirely if not essential. These mitigations may break legitimate functionality; monitor for unintended impacts and apply a vendor patch immediately once available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
sysPass is a PHP-based password manager developed by nuxsmin, as indicated by CPE cpe:2.3:a:nuxsmin:syspass:*:*:*:*:*:*:*:*. The vulnerability is classified as CWE-639 (Insecure Direct Object Reference), arising from insufficient authorization verification in the AccountFileController component. The controller fails to validate if the authenticated user has the necessary account-level access controls before performing file operations (download, view, delete, upload, list). Because file objects are referenced by predictable numeric IDs, an attacker can iterate over IDs to manipulate any attachment within the vault, undermining the entire access control model.
Know when Syspass gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network vector, low complexity, low privileges required, no user interaction, and high confidentiality/integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions to enumerate and manipulate any attachment in the vault, bypassing account-level access controls entirely.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
We are tasked to synthesize data about CVE-2026-65711 into a JSON object. We must use all provided data: description, CV
Missing object-level authorization in sysPass through 3.2.11 allows API token holders to enumerate account metadata, ove
A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary do
Privilege escalation in sysPass 3.2.11 allows authenticated users with the PUBLICLINK_CREATE profile flag to decrypt pas
SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitra
The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. Rated m
inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of
Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files
A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to e
An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographe
A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML vi
Exploit-DB