Craftplan CVE-2026-76876

Exploitation requires two conditions: (1) the attacker can reach the Craftplan Settings JSON:API endpoint over the network, and (2) the attacker possesses or can enumerate a valid Settings record ID. The record ID is not publicly disclosed and must be obtained through prior reconnaissance - this is the basis for the AC:H rating in the CVSS 4.0 vector. No authentication, user interaction, special platform, or non-default configuration is required beyond network reachability and a valid ID. Limiting factors include: the need to enumerate or guess a valid record ID before exploitation succeeds, and the impact being confined to credential confidentiality (no integrity or availability impact on the Craftplan instance itself). Craftplan deployments isolated from untrusted networks are protected by network boundaries rather than by any application-layer control.

The CVSS 4.0 score of 8.2 reflects a remotely accessible credential-disclosure flaw with no authentication requirement (PR:N) and high confidentiality impact (VC:H). However, AC:H is a meaningful modifier: the attacker must supply a valid Settings record ID, which is not publicly known by default and requires prior reconnaissance or enumeration. This complexity gap limits opportunistic mass exploitation but does not protect against a targeted attacker who has already obtained an ID through other means. No EPSS probability data was supplied in the available intelligence, and no CISA KEV entry or public exploit code has been identified - exploitation probability and breadth remain unknown. The credential types at risk (SMTP passwords, email provider API keys and secrets) carry outsized downstream harm: they can enable account-takeover via password-reset hijacking, impersonation phishing sent from a trusted mail server, or abuse of third-party email-service quotas and reputation - risks that extend well beyond the Craftplan instance itself. Any organization running an internet-exposed Craftplan deployment should treat this as urgent even absent confirmed exploitation.

An attacker targeting an internet-facing Craftplan instance enumerates or infers a valid Settings record ID - for example by observing application behavior, API responses in an authenticated session on a shared instance, or brute-forcing sequential IDs - then issues an unauthenticated GET request to the Settings JSON:API endpoint. The response body returns decrypted SMTP credentials and email provider API keys, which the attacker uses to dispatch phishing emails through the victim organization's trusted mail server or to access the victim's email service account directly. No public exploit code has been identified at time of analysis, but the technique requires only standard HTTP tooling once a valid record ID is obtained.