tsi-dpdp-cms CVE-2026-84840

No special conditions are required for the bootstrap endpoint attack: the endpoint accepts unauthenticated POST requests with no token, no session, and no one-time-use guard on all versions through 0.5.0, and the impact is greatest on fresh deployments or after a configuration reset before any administrator account has been established. For the console-page disclosure issue, no credentials are required; any HTTP client issuing a plain request to the admin or DPO console paths receives full page source. The only practical limiting factor is network reachability - instances not exposed to untrusted networks are not remotely exploitable. No specific platform, OS, or feature flag is required beyond a running tsi-dpdp-cms ≤0.5.0 instance.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects zero-barrier remote exploitation with no prerequisites, but the VI:L/VA:L impact ratings appear to understate real-world consequence - the bootstrap endpoint permits an attacker to register an attacker-controlled super-admin account, which constitutes full administrative compromise rather than a low-integrity impact. This discrepancy should be flagged to the reporting source. The E:P supplemental metric correctly reflects the publicly available GitHub PoC. No CISA KEV listing is present, indicating no confirmed widespread in-the-wild exploitation at time of analysis, though PoC availability materially raises that probability. EPSS data was not provided in the input. The niche deployment footprint of this product limits broad population exposure, but any network-reachable unpatched instance represents a critical-severity posture: exploitation requires no credentials, no special conditions, and no user interaction, meaning even an operator team running a single instance should treat this as immediately actionable.

A remote attacker scans for internet-exposed tsi-dpdp-cms instances, identifies one in a fresh or recently reset state, and sends a crafted unauthenticated POST to /api/v1/bootstrap/setup to register an attacker-controlled super-admin account - granting full administrative access to the CMS and all managed data. The publicly available proof-of-concept at https://github.com/mano257200/TSI-DPDP-CMS-Unauthenticated-Super-Admin-Bootstrap-Endpoint reduces the technical barrier to near zero.