EUVD-2026-54970
GHSA-86p9-mgrp-3g8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify public Badaso instance
-
ExploitSend unauthenticated HTTP request to File API
-
ExecutionBypass permission check in ApiRequest::class
-
ImpactAccess or manipulate restricted file resources
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Permission management
|
| Exploitation Conditions | No authentication is required (PR:N) and no special configuration is needed beyond having the File API routes exposed, which is the default state of a Badaso installation. The attack is network-accessible (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N). Exploitation is limited by the impact scope: only confidentiality, integrity, and availability of the vulnerable system's file resources are affected at a limited level (VC:L/VI:L/VA:L) with no lateral impact to other systems (SC:N/SI:N/SA:N). The primary limiting factor is deployment exposure - instances not accessible from untrusted networks are not remotely exploitable. The alpha-stage software label may also limit production deployments. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-exploitable, low-complexity, unauthenticated access with no special attack requirements, but the impact metrics are moderate (VC:L/VI:L/VA:L), reflecting limited confidentiality, integrity, and availability impact with no downstream system effects. The E:P exploitability modifier confirms public proof-of-concept code exists. Despite the moderate aggregate score of 6.9, the PR:N/AC:L combination means exploitation is trivially automatable - even a mid-sized municipal IT team in kielce running a public-facing Badaso instance would face real exposure if the File API is internet-accessible. No CISA KEV listing is present, suggesting no confirmed mass exploitation at time of analysis, though POC availability raises the probability. The vendor's non-responsiveness to the coordinated disclosure is a material aggravating factor, as no patch timeline is established. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request to the exposed File API endpoint of a publicly accessible Badaso 3.0.0-alpha instance. Due to missing permission checks in ApiRequest::class, the server processes the request without validating authorization, allowing the attacker to enumerate, read, or modify files accessible to the application. A public proof-of-concept has been disclosed via GitHub, lowering the bar for exploitation to script-kiddie level. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 10, 2026
Unauthenticated remote exploitation of Badaso 3.0.0-alpha's File API allows attackers to bypass permission controls in ApiRequest::class (src/Routes/api.php), resulting in unauthorized read, write, and access operations on file resources. The vulnerability stems from improper permission assignment (CWE-275) in the PHP-based File API route handler. A public exploit has been disclosed via a GitHub issue; the vendor has not responded to the coordinated disclosure.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project was informed via a GitHub issue (https://github.com/uasoft-indonesia/badaso/issues/1100) but has not responded. Given the pre-release (alpha) nature of the software, production deployment should be avoided entirely. As an immediate compensating control, restrict access to the File API routes (src/Routes/api.php) at the web server or reverse proxy layer, blocking unauthenticated external requests to those endpoints. If Badaso is deployed behind a perimeter, implement network-level controls to prevent public internet access to the admin panel. Monitor VulDB (https://vuldb.com/cve/CVE-2026-19376) and the GitHub repository for patch releases. Consider migrating to an actively maintained CMS alternative if a vendor patch is not forthcoming.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Badaso is a PHP-based open-source CMS/admin panel framework built on Laravel, developed by uasoft-indonesia. The vulnerability resides in the ApiRequest::class handler within src/Routes/api.php, which constitutes the File API endpoint. CWE-275 (Improper Privilege Management / Permission Assignment for Resource) indicates that the route fails to enforce adequate access controls before processing file-related operations, allowing unauthenticated callers to interact with resources that should be restricted. The affected version is 3.0.0-alpha, as confirmed by CPE cpe:2.3:a:uasoft:badaso:*:*:*:*:*:*:*:*. The alpha designation suggests this may be pre-release software without hardened access control middleware.
Know when Badaso gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network vector with no auth or complexity required per description; limited C/I/A impact with no scope change, consistent with file-level permission bypass.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. Rated c
Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. Rated c
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via
Cross Site Scripting vulnerabiltiy in Badaso v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted pa
A stored cross-site scripting (XSS) vulnerability in the Edit Category function of Badaso v2.9.7 allows attackers to exe
Weak password recovery in Badaso's authentication controller (up to v2.9.7) allows remote attackers to exploit a flawed
A stored cross-site scripting (XSS) vulnerability in the Add Tag function of Badaso v2.9.7 allows attackers to execute a
An arbitrary code execution vulnerability in Badaso CMS 2.9.11. Rated critical severity (CVSS 9.8), this vulnerability i
Exploit-DB