What is the CVSS score of CVE-2026-67687?

CVE-2026-67687 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of ICS-Park are affected by CVE-2026-67687?

ICS-Park Smart Park Management System v2.0 contains a privilege escalation vulnerability allowing any authenticated user-including operators and contractors-to grant themselves administrative…

Is there a public PoC exploit available for CVE-2026-67687?

Yes, a public proof-of-concept exploit is available for CVE-2026-67687. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-67687?

Within 24 hours: Identify all ICS-Park v2.0 instances in production and immediately restrict network access to the /system/role/save and /system/user/update endpoints to authorized administrator networks only, using firewall rules or reverse-proxy controls. Within 7 days: Implement comprehensive logging and alerting for role and user modifications, enforce multi-factor authentication for all administrative accounts, and deploy rate-limiting on these endpoints to detect exploitation attempts. Within 30 days: Contact the ICS-Park vendor to confirm patch timeline; evaluate compensating controls such as network segmentation, dual-approval workflows for privilege changes, and role-based API access restrictions; and assess alternative smart-parking platforms if the vendor cannot commit to remediation within 90 days.

ICS-Park CVE-2026-67687

EUVD-2026-54307 HIGH

Improper Access Control (CWE-284)

2026-08-06 cve@mitre.org

GHSA-gq4q-rm4c-4cm7

Authentication Bypass Java

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable endpoints require only a low-privilege authenticated session; no complexity or interaction barriers exist, and full system CIA impact follows successful role escalation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 16:23 vuln.today

CVSS changed

Aug 07, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Aug 06, 2026 - 22:18 cve.org

HIGH 8.8

CVE Published

Aug 06, 2026 - 22:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java

AnalysisAI

Privilege escalation in ICS-Park Smart Park Management System v2.0 allows any authenticated low-privilege user to assume higher roles by sending crafted requests directly to the /system/role/save and /system/user/update endpoints, bypassing server-side authorization checks. The flaw affects RoleController.java and UserController.java, which fail to enforce permission boundaries before persisting role or user modifications. No public exploitation confirmed in CISA KEV, but a proof-of-concept is publicly available on GitHub, concretely lowering the bar for abuse by any user with a valid session.

Technical ContextAI

ICS-Park is a Java-based Smart Park Management System (v2.0). CWE-284 (Improper Access Control) is the root cause: the application exposes administrative role-management (/system/role/save via RoleController.java) and user-update (/system/user/update via UserController.java) HTTP endpoints without enforcing that the requesting principal holds sufficient privileges to perform those operations. Any authenticated session can send POST/PUT requests to these endpoints with attacker-controlled payloads to assign elevated roles to arbitrary accounts. No CPE string was provided by NVD; the EUVD records the affected version set as 'n/a n/a', indicating version metadata is incomplete. The Java tag confirms a server-side application; the Authentication Bypass tag reflects the effective outcome when authorization is missing despite authentication being required.

RemediationAI

No vendor-released patch or official advisory has been identified at the time of this analysis; the available references point only to researcher-published exploit code and the NVD entry. Until a vendor patch is available, operators should apply server-side authorization middleware or framework-level access control annotations (e.g., Spring Security @PreAuthorize) to the /system/role/save and /system/user/update endpoints, restricting them to accounts explicitly holding an administrator role - be aware this requires code-level changes and a rebuild/redeploy. As an immediate compensating control, restrict network-layer access to these specific endpoints at the API gateway or reverse proxy (e.g., block POST to /system/role/save and /system/user/update from non-admin source IPs or internal management VLANs only); the trade-off is operational friction for any legitimate low-privilege use of those paths. Additionally, audit all existing user and role assignments in the database for unauthorized privilege escalation that may have already occurred. Monitor the researcher's GitHub repository (https://github.com/qflksheep/CVE-2026-67687-ICS-Park-Smart-Park-Management-System-v2.0) for any vendor-supplied fix references.