EUVD-2026-64068
GHSA-q329-hwc8-2x8j
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated read; AC:H reflects mandatory valid record ID; confidentiality-only impact with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.
AnalysisAI
Craftplan versions prior to 0.5.1 expose decrypted SMTP passwords, email API keys, and email API secrets to unauthenticated network attackers via a broken always-allow authorization policy on the Settings JSON:API resource. Exploitation requires only a valid Settings record ID and a standard GET request - no credentials or elevated access are needed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions: (1) the attacker can reach the Craftplan Settings JSON:API endpoint over the network, and (2) the attacker possesses or can enumerate a valid Settings record ID. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.2 reflects a remotely accessible credential-disclosure flaw with no authentication requirement (PR:N) and high confidentiality impact (VC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting an internet-facing Craftplan instance enumerates or infers a valid Settings record ID - for example by observing application behavior, API responses in an authenticated session on a shared instance, or brute-forcing sequential IDs - then issues an unauthenticated GET request to the Settings JSON:API endpoint. The response body returns decrypted SMTP credentials and email provider API keys, which the attacker uses to dispatch phishing emails through the victim organization's trusted mail server or to access the victim's email service account directly. … |
| Remediation | Upgrade Craftplan to version 0.5.1 or later immediately; this is the vendor-released patch confirmed by the GitHub release at https://github.com/puemos/craftplan/releases/tag/v0.5.1 and commit 317acd584b68887f592dc3b97f47703dd63b1bf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, upgrade all affected Craftplan instances to version 0.5.1 or later. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today