tsi-dpdp-cms CVE-2026-84839

No special conditions are required for the console-page disclosure: exploitation targets default deployments of tsi-dpdp-cms ≤0.5.0 exposed to any network-reachable HTTP client with no credentials, no user interaction, and no non-default configuration. Any of the 17 admin or DPO console URL paths is sufficient entry. Limiting factors include the product's niche deployment footprint (DPDP compliance use case), the need to know or discover the application's URL paths, and the fact that the primary confirmed impact is information disclosure of admin UI structure rather than direct data exfiltration or command execution. The related bootstrap endpoint vulnerability (/api/v1/bootstrap/setup) carries a higher integrity impact but is limited to fresh or recently reset deployments where the super-admin account has not yet been configured.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/E:P) and score of 6.9 reflect a remotely exploitable, no-interaction information disclosure with a public POC. The VC:L rating may understate operational risk: the disclosed content includes internal API endpoint paths, request parameter schemas, and function names across 17 administrative screens, providing an attacker a detailed blueprint for further targeted attacks against the API layer. Exploitation complexity is genuinely low - the POC demonstrates that a basic curl request suffices, requiring no tooling, credentials, or special network position. The absence of CISA KEV listing suggests no confirmed mass exploitation at time of analysis, but the public POC and trivial exploit conditions make opportunistic targeting plausible. Compensating factor: the affected product appears to have a small, specialized deployment footprint, limiting the pool of reachable targets. The separately disclosed bootstrap endpoint vulnerability (also fixed in v0.5.1) represents a higher-integrity impact for fresh deployments, potentially allowing full admin account seizure, though that is a distinct finding.

An unauthenticated attacker discovers a tsi-dpdp-cms deployment via web scanning and sends a plain HTTP GET request to a known admin console path (e.g., /admin/dashboard). The servlet container, finding no web.xml security constraint, serves the full page HTML including embedded JavaScript that references internal API endpoint paths, parameter schemas, and function names. The attacker uses this blueprint to craft targeted requests against the API, potentially escalating to further compromise of data-subject records or DPO workflows. The public POC on GitHub (https://github.com/mano257200/TSI-DPDP-CMS-Missing-Authentication) confirms this requires no special tooling.