EUVD-2026-74057
GHSA-c5q2-j46h-2h3p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires independently compromised vault credentials; C:H because successful unsealing exposes all stored SSH keys and API secrets; no integrity or availability impact from the unsealing action itself.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_handler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 20260819.01 is sufficient to fix this issue. The name of the patch is 3b92dd64d5648f829968cf48bf67dc3113852fef. Upgrading the affected component is advised.
AnalysisAI
Missing session authentication on vault unlock and recovery endpoints in moltis-org/moltis allows a remote unauthenticated attacker to attempt vault unsealing using only a stolen vault password or recovery key phrase, bypassing the intended dual-layer session-plus-credential security model. All versions through 20260818.10 are affected; the /api/auth/* path was globally allowlisted in is_public_path(), which caused the AuthSession middleware extractor to be silently skipped for both vault_unlock_handler and vault_recovery_handler. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target moltis instance must be compiled and deployed with the `vault` feature enabled alongside the `web-ui` feature, as confirmed by the conditional test compilation flags `#[cfg(all(feature = "web-ui", feature = "vault"))]`; (2) the attacker must independently possess either the vault password or the recovery key phrase - the missing session check does not grant secrets without these credentials; (3) the vault must currently be in a sealed state, as an already-unsealed vault is not affected by these endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, score 5.5) correctly identifies the remote unauthenticated attack surface but appears to understate vault confidentiality impact - SSH private keys and API credentials warrant VC:H upon successful unsealing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to moltis version 20260819.01, available at https://github.com/moltis-org/moltis/releases/tag/20260819.01, which incorporates fix commit 3b92dd64d5648f829968cf48bf67dc3113852fef via PR #1216 (https://github.com/moltis-org/moltis/pull/1216). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today