MeWare PDKS CVE-2026-7382

Exploitation requires valid authenticated credentials with at least standard user privileges (PR:L) - the vulnerability does NOT grant unauthenticated access. The attacker must have direct network connectivity to PDKS (or connectivity through corporate network if internal deployment), and PDKS must be operational and accepting connections. The vulnerable condition is the absence of proper role-based or attribute-based access control validation when authenticated users request other users' personal data - no special configuration, feature toggle, or non-standard deployment mode is required. Default or standard configurations of PDKS versions 16.20200313 to before VMYR_3.5.2025117 are vulnerable. Limiting factors include: required valid user credentials (reduces threat model to insider threats or compromised accounts), and encrypted/tokenized transport layers which do not prevent the authorization flaw but may slow data exfiltration.

CVSS 6.5 with network vector and low complexity indicates moderate-to-significant real-world risk, but the authenticated requirement (PR:L) substantially limits attack surface compared to unauthenticated network exploits. The absence of KEV confirmation, POC availability, and public exploitation claims suggests this is not an immediate mass-exploitation target, though legitimate users with system access pose an insider threat. The information disclosure impact (C:H/I:N/A:N) means confidentiality is compromised but integrity and availability remain intact, reducing operational impact compared to destructive vulnerabilities. Organizations with strict data protection regulations (GDPR, HIPAA, etc.) must prioritize this despite the moderate CVSS, as unauthorized personal data exposure carries significant compliance and reputational risk. Real-world priority depends on whether PDKS is internet-facing (enabling remote-authenticated attack) or internal-only (reducing threat model to trusted insiders with credentials).

An employee or contractor with standard PDKS user credentials (PR:L) connects remotely to the application and submits API or UI requests targeting other users' personal information records, exploiting insufficient authorization checks to retrieve private data not assigned to their role. The low complexity means no special techniques or race conditions are required; standard authenticated requests suffice. Within minutes, the attacker exfiltrates customer personal data (names, contact info, identifiers, etc.) to external storage for sale or competitive intelligence.