EUVD-2026-70255
GHSA-xvjh-cx5w-2fp2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
All 17 admin pages exposed unauthenticated (C:H); unauthenticated super-admin bootstrap allows full account takeover (I:H); no availability impact confirmed; S:C because auth bypass crosses privilege boundary.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.1 is able to resolve this issue. It is recommended to upgrade the affected component.
AnalysisAI
Missing server-side authentication in tsi-coop tsi-dpdp-cms ≤0.5.0 exposes all 17 admin and DPO console pages to unauthenticated HTTP clients: the application enforced access via a client-side JavaScript redirect only, so any HTTP request that ignores the redirect receives the full page source including internal API endpoints, function names, and request schemas. A second bundled vulnerability allows unauthenticated super-admin account creation via an unprotected first-run setup endpoint (/api/v1/bootstrap/setup), enabling complete platform takeover on fresh or reset deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | For the admin console bypass: every deployment of tsi-dpdp-cms ≤0.5.0 is unconditionally exploitable with no authentication, no special configuration, and no user interaction - any HTTP client that issues a direct request to an admin or DPO console URL while ignoring the 302 JavaScript redirect receives the full page response. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 5.5 with VC:L/VI:L/VA:L materially understates actual impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to tsi-dpdp-cms v0.5.1 immediately; the release is confirmed at https://github.com/tsi-coop/tsi-dpdp-cms/releases/tag/v0.5.1 and adds server-side session enforcement - a new login cookie kept separate from the existing API bearer token - to all 17 admin and DPO console pages. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Tsi Dpdp Cms
View allMissing server-side authentication on all 17 admin and DPO compliance console pages in tsi-dpdp-cms ≤0.5.0 allows any un
Unauthenticated access to the first-run Super-Admin bootstrap endpoint (/api/v1/bootstrap/setup) and all 17 admin/DPO co
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today