EUVD-2026-38235
GHSA-m4p9-xhxv-6pf5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated player (PR:L) can reach a network endpoint (AV:N/AC:L/UI:N); mass-assignment yields full C/I/A impact and SSRF crosses a trust boundary (S:C).
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
Lifecycle Timeline
1DescriptionCVE.org
The vulnerability is present in the ‘/addJugador’ endpoint:
- The 'keyJugador' and 'keyJugadorObjectiu' parameters allow the modification of other users’ information without requiring prior authorization validation. This could enable an authenticated attacker to alter any user’s ID and change their information.
- The ‘punts’ and ‘numObjectiusEliminats’ fields allow arbitrary data to be added because user input is not properly validated. This makes it possible to obtain authentic prizes, awarded by city councils, by falsifying game scores.
- In the ‘tokens’ field, administrative privileges can be self-assigned without server validation or prior authentication. This vulnerability could allow an authenticated attacker to grant themselves administrator permissions and thus escalate privileges.
- Numeric fields allow the entry of extremely long values, which can cause the system to crash. Successful exploitation of this vulnerability could allow an authenticated attacker to launch a denial-of-service (DoS) attack, preventing created games from being playable.
- The ‘urlImatge’ parameter allows server-side requests to arbitrary URLs, enabling the retrieval of users’ internal IP addresses, access to internal services, reading of local files, and unauthorized interaction with third-party APIs. An authenticated attacker could gain access to sensitive data.
AnalysisAI
Multiple chained vulnerabilities in Gaudire's Assassin Game platform allow an authenticated low-privileged player to tamper with other users' accounts, escalate to administrator, defraud city-council-awarded prizes, trigger denial-of-service, and perform server-side request forgery via the /addJugador endpoint. With CVSS 4.0 base score 9.4 (Critical) and scope-changing impact across confidentiality, integrity, and availability, the flaws stem from systemic input validation failures (CWE-20). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Assassin Game is a gamified municipal engagement application by Gaudire (CPE 2.3:a:gaudire:assassin_game) where players earn points and real prizes funded by city councils. The /addJugador (Spanish/Catalan for 'addPlayer') REST endpoint accepts a JSON document whose fields are written to backend records without authorization or schema enforcement, the canonical CWE-20 (Improper Input Validation) pattern. Trusted-client design choices - accepting caller-supplied identity keys (keyJugador, keyJugadorObjectiu), score fields (punts, numObjectiusEliminats), a privilege/role field (tokens), and an unrestricted URL fetcher (urlImatge) - combine IDOR, mass-assignment privilege escalation, business-logic fraud, integer/length-handling DoS, and SSRF in a single attack surface.
RemediationAI
No vendor-released patch identified at time of analysis from the supplied data; consult the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-assassin-game-gaudire and Gaudire directly for a fixed build. Compensating controls: at the API gateway, drop or strip the tokens, keyJugador, keyJugadorObjectiu, punts, and numObjectiusEliminats fields from inbound /addJugador requests so the server cannot honor client-supplied identity or role (side effect: legitimate score updates must be re-routed to a server-authoritative endpoint); enforce server-side authorization that the session principal matches the player record being modified; deny-list internal RFC1918, link-local, and metadata IP ranges plus file:// schemes for urlImatge fetches, or proxy them through an egress filter (side effect: third-party avatar hosts must be allow-listed); add length and type validation on numeric fields to prevent DoS; audit existing accounts for unauthorized administrator tokens and reconcile prize ledgers against game telemetry for fraudulent point inflation before any prize distribution.
More in Assassin Game
View allSensitive information disclosure in Gaudire's Assassin Game application allows unauthenticated remote attackers to retri
Email validation bypass in Gaudire's Assassin Game permits registration with arbitrary or non-existent email addresses,
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today