Kodexplorer EUVD-2026-23700

Exploitation requires an authenticated user account with at least basic login credentials-the vulnerability cannot be exploited by unauthenticated remote attackers. The attack targets the roleGroupAction function specifically when processing group_role parameter manipulation, meaning the vulnerable endpoint must be accessible and the application must be using the standard role-based access control system. No explicit non-default configuration is required; default KodExplorer installations with user accounts enabled are vulnerable. The limiting factors are: (1) authentication requirement (PR:L in CVSS)-attacker must possess valid user credentials or have previously compromised a low-privilege account; (2) the vulnerability is confined to role group assignment operations and does not extend to other administrative functions without role escalation; (3) exploitation requires the web application to be actively processing role management requests (standard in multi-user or shared deployments but potentially limited in single-user instances).

The risk profile presents a moderate but concrete threat requiring immediate attention. The CVSS 6.3 score with AV:N/AC:L reflects network-accessible exploitation with low attack complexity, but the requirement for PR:L (authenticated user privileges) significantly limits the immediate attack surface-this is not an unauthenticated remote code execution scenario. However, the E:P (exploit proof-of-concept exists) rating and public availability of working exploit code substantially elevate practical exploitation likelihood compared to purely theoretical high-CVSS vulnerabilities. The vendor's non-response to early disclosure is a critical signal: organizations cannot rely on official patches and must implement compensating controls immediately. The authorization bypass nature (CWE-639) typically allows rapid privilege escalation once initial authentication is obtained-a low-complexity pivot from standard user to administrative roles. Notably, KEV status is not confirmed in the provided data, but public exploit availability combined with low AC and vendor abandonment suggest realistic near-term exploitation. Organizations with public-facing KodExplorer instances or multi-user deployments should treat this as a priority, whereas isolated single-user installations face lower immediate risk.

An authenticated regular user logs into a KodExplorer instance with standard file management permissions. The attacker crafts a malicious HTTP request to the roleGroupAction function, manipulating the group_role parameter to assign themselves to an administrative role group. Due to insufficient authorization checks, the application processes this request and elevates the user's privileges without proper validation. The attacker can now access administrative functions, modify system settings, and potentially extract sensitive data or establish persistence.