Psono Server EUVD-2026-110606

Exploitation requires ALL of: (1) the Psono Server (CE or EE, versions 4.0.33-7.2.3) deployed with the non-default URL_PREFIX configuration - the default unprefixed deployment is explicitly not affected; (2) an authenticated remote attacker holding an API key with the unusual scope combination of read-disabled but write-enabled; and (3) requests sent to the prefixed bulk-secret-read endpoint, where the server's hard-coded unprefixed path comparison fails and authorizes under write scope. Limiting factors that reduce realistic risk: the URL_PREFIX setting is not the default, the required read-disabled/write-enabled key scope is atypical, the attacker must already be authenticated (PR:L), and the exposed secret data and nonces are encrypted.

This is a medium-severity authorization (scope) bypass with real-world risk materially lower than a raw read of the CVSS vector would suggest. The supplied vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N scores 4.3 and implies an easy network-reachable, low-privilege attack, but the description constrains exploitation to two non-default preconditions that the vector's AC:L does not reflect: the deployment must be configured with URL_PREFIX (the default, unprefixed configuration is explicitly not affected per the vendor), and the attacker must hold an unusual API key that is read-disabled but write-enabled. EPSS is low at 0.32% (25th percentile) and there is no CISA KEV listing - consistent with no evidence of active exploitation - and no public exploit was identified. The impact is confidentiality-only (C:L, I:N, A:N) and the retrieved secret data and nonces are encrypted, further limiting practical impact. The vuln.today decision label is 'this_month', indicating a normal patch-cycle priority rather than an emergency. Net: a genuine but narrow authorization flaw that is a scheduled-remediation item, not a high-urgency widespread threat. Note the tension to verify: the input CVSS uses AC:L despite the description establishing a non-default configuration plus an atypical key-scope combination as prerequisites - these preconditions arguably warrant higher attack complexity than the published vector reflects.

An authenticated user (or holder of a leaked API key) possessing a credential scoped for write but explicitly denied read access targets a Psono Server instance deployed behind a URL_PREFIX. They send a POST to the prefixed bulk-secret-read endpoint; because the server compares the prefixed request path against a hard-coded unprefixed path, the read-scope check fails open and the request is authorized under write scope, returning encrypted secret data and nonces the key should not be able to read. No public exploit code was identified, and the attack requires the non-default URL_PREFIX configuration and the unusual read-disabled/write-enabled key.