EUVD-2026-52565
GHSA-mv6j-rvc6-f296
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint with no user interaction; impact limited to low confidentiality, no integrity or availability effect confirmed.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the msgWarning plugin endpoint, resulting in limited unauthorized access to confidential data. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication is required, and a public proof-of-concept exploit has been published on GitHub. The vendor did not respond to responsible disclosure, leaving no confirmed patch available at time of analysis.
Technical ContextAI
KodBox is a PHP-based self-hosted file management and team collaboration platform developed by kalcaddle. The vulnerable component is the msgWarning plugin, exposed at the endpoint /index.php?plugin/msgWarning/action. CWE-285 (Improper Authorization) indicates the application fails to correctly enforce access control on this plugin action - either the authorization check is absent, circumventable, or incorrectly scoped - allowing requests that should be gated to pass through without valid credentials or session context. The PHP tag on the CVE and the plugin architecture suggest the flaw is likely a missing or bypassable middleware authorization gate specific to this plugin route. The CPE string cpe:2.3:a:kalcaddle:kodbox:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting NVD has not constrained the vulnerable range to a single release.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to the responsible disclosure attempt, so no fix version can be cited. For internet-exposed KodBox instances, the most actionable immediate control is to block or restrict external access to the specific endpoint /index.php?plugin/msgWarning/action via a web application firewall rule or reverse proxy ACL - this limits exposure without disabling the entire application, though it does not eliminate the underlying authorization flaw for internal users. Disabling the msgWarning plugin entirely, if the feature is non-essential to operations, is the next-most-effective compensating control. Placing KodBox behind VPN or IP allowlisting removes the network-accessible attack vector entirely (AV:N becomes moot) at the cost of remote usability. Monitor the GitHub PoC at https://github.com/sjmycz/cve/issues/4 and VulDB at https://vuldb.com/vuln/385631 for any vendor patch release. Consider migrating to an alternative platform if vendor responsiveness is a compliance requirement.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today