Skip to main content

sysPass CVE-2026-65708

| EUVDEUVD-2026-48714 HIGH
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-07-24 VulnCheck GHSA-m6m7-rqhj-c4vv
Authentication Bypass Hashicorp Syspass
8.6
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

Network vector, low complexity, low privileges required, no user interaction, and high confidentiality/integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 26, 2026 - 11:44 vuln.today
CVE Published
Jul 24, 2026 - 15:57 cve.org
HIGH 8.6

DescriptionCVE.org

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions to enumerate and manipulate any attachment in the vault, bypassing account-level access controls entirely.

AnalysisAI

Authenticated attackers can bypass access controls in sysPass 3.2.11 and earlier to access, download, or delete any account file attachment, regardless of their ACL permissions, by exploiting missing authorization checks in AccountFileController. Public exploit code is available, but the EPSS score of 0.22% indicates low likelihood of widespread exploitation.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate with low privileges
Exploit
Brute-force numeric file IDs
Execution
Request attachment via download/view endpoint
Impact
Access or manipulate files without ACL permission
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires authenticated access to sysPass with any user role. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.6 reflects high impact (VC:H/VI:H) but requires low privileges (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with low-privileged authenticated access enumerates numeric file IDs by iterating requests to the download or view endpoint. The attacker retrieves sensitive attachments (e.g., SSH keys, password lists) from accounts they are not authorized to access. …
Remediation No vendor-released patch has been identified at the time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Syspass

View all
CVE-2026-65711 HIGH POC
8.6 Jul 24

We are tasked to synthesize data about CVE-2026-65711 into a JSON object. We must use all provided data: description, CV
CVE-2026-65709 HIGH POC
8.7 Jul 24

Missing object-level authorization in sysPass through 3.2.11 allows API token holders to enumerate account metadata, ove
CVE-2025-25477 HIGH POC
8.1 Feb 28

A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary do
CVE-2026-65710 HIGH POC
7.1 Jul 24

Privilege escalation in sysPass 3.2.11 allows authenticated users with the PUBLICLINK_CREATE profile flag to decrypt pas
CVE-2015-6516 MEDIUM POC
6.5 Aug 18

SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitra
CVE-2025-25478 MEDIUM POC
6.5 Feb 28

The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. Rated m
CVE-2017-9306 MEDIUM POC
6.1 May 31

inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of

CVE-2017-1000192 CRITICAL
9.8 Nov 17

Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files

CVE-2025-25476 MEDIUM POC
5.4 Feb 28

A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to e
CVE-2017-5999 HIGH
7.5 Mar 06

An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographe
CVE-2024-42904 MEDIUM
6.1 Sep 03

A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML vi

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8
CVE-2024-27730 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-65708 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy