EUVD-2026-40153
GHSA-4pqr-v6c3-x77j
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires authenticated low-privilege session (PR:L) and high complexity (AC:H); limited low-level CIA impact with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTrackedConversation of the file src/managers/ChannelBridge.ts of the component Contact Tracking. This manipulation of the argument _channelType causes improper authorization. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48. It is suggested to install a patch to address this issue.
AnalysisAI
Improper authorization in DeepMyst Mysti 0.4.0 permits authenticated remote attackers to bypass access controls in the Contact Tracking component by supplying a manipulated _channelType argument to the _isTrackedConversation function in src/managers/ChannelBridge.ts. The CVSS 4.0 score of 1.3 reflects genuine low severity - all CIA impacts are rated Low and no subsequent system scope is affected. Publicly available exploit code exists (CVSS E:P confirmed), but no active exploitation has been confirmed by CISA KEV, and high attack complexity (AC:H) with required authenticated access (PR:L) substantially limits opportunistic abuse.
Technical ContextAI
DeepMyst Mysti is a conversation and channel bridging application; the affected module src/managers/ChannelBridge.ts manages Contact Tracking by determining whether a given conversation is being tracked via the _isTrackedConversation function. CWE-266 (Incorrect Privilege Assignment) identifies the root cause class: the authorization logic governing which channel types a caller may query fails to adequately validate or restrict the _channelType argument, allowing a caller to supply values outside their privilege scope and circumvent the tracking authorization gate. No CPE string was provided in source data; affected product is identified solely as DeepMyst Mysti 0.4.0 per VulDB and NVD references.
RemediationAI
Apply the upstream fix via Git commit 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48, available at https://github.com/DeepMyst/Mysti/commit/9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48, and monitor the associated pull request at https://github.com/DeepMyst/Mysti/pull/43 for a formally tagged release. A versioned patched release has not been independently confirmed - the fix is traceable only to a commit and PR at time of analysis, so organizations should apply the commit directly rather than waiting for a package release. As a compensating control, restrict authenticated access to the Contact Tracking feature to the minimum set of trusted users required, and implement server-side validation rejecting unexpected or unsupported _channelType values at the API boundary; note this workaround may require application-layer changes and could cause feature degradation if valid channel type enumerations are not well-documented.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today