tsi-dpdp-cms CVE-2026-84841

For the admin console bypass: every deployment of tsi-dpdp-cms ≤0.5.0 is unconditionally exploitable with no authentication, no special configuration, and no user interaction - any HTTP client that issues a direct request to an admin or DPO console URL while ignoring the 302 JavaScript redirect receives the full page response. For the super-admin bootstrap takeover: the target must be a fresh deployment or one where the setup has been reset, meaning the /api/v1/bootstrap/setup endpoint has not yet been completed and token-locked. Both attack paths require network-level reachability to the CMS HTTP port; if the application is restricted to an internal network segment, the attacker must first gain access to that segment. There are no other special prerequisites - no account, no session, and no specific browser or platform are required.

The provided CVSS 4.0 score of 5.5 with VC:L/VI:L/VA:L materially understates actual impact. The vendor's own release notes confirm that all 17 admin and DPO console pages - including internal API endpoint paths, function signatures, and request schemas - are served in full to unauthenticated requests, which constitutes a high confidentiality impact (VC:H), not low. The unauthenticated bootstrap endpoint additionally permits complete super-admin account claiming, representing a high integrity impact (VI:H), not low. The CVSS 4.0 supplemental modifier E:P (proof-of-concept exists) is confirmed by a public GitHub PoC repository referenced in the CVE. With AV:N/AC:L/PR:N/UI:N and a public exploit, this is trivially exploitable by any remote attacker. Key limiting factors are: (1) the bootstrap super-admin takeover requires a fresh or recently-reset deployment; (2) the product has an extremely narrow deployment footprint as a niche DPDP compliance CMS; (3) no CISA KEV listing was identified at time of analysis. For deployments that are internet-facing and running ≤0.5.0, this should be treated as critical priority despite the understated CVSS.

A remote unauthenticated attacker issues a direct HTTP GET to any admin console URL (e.g., curl --location-trusted or a simple HTTP client that does not execute JavaScript), bypassing the client-side redirect and receiving the complete admin page HTML including internal API endpoint paths, function names, and request schemas. On a fresh or recently-reset deployment, the attacker follows up with an unauthenticated POST to /api/v1/bootstrap/setup to register a super-admin account, then logs in with full administrative control over the DPDP compliance platform. A public PoC repository demonstrating this exact technique is available at the referenced GitHub exploit link.