What is the CVSS score of EUVD-2026-66167?

EUVD-2026-66167 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

GazellePW EUVD-2026-66167

| CVE-2026-38470 MEDIUM

Improper Access Control (CWE-284)

2026-08-25 cve@mitre.org

GHSA-55f9-r7cc-h5pv

4.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network API requires authenticated credentials (PR:L); account disabling introduces availability impact (A:L) omitted from the provided vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Aug 31, 2026 - 17:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Aug 31, 2026 - 17:36 vuln.today

CVSS changed

Aug 31, 2026 - 15:22 NVD

4.3 (MEDIUM)

CVE Published

Aug 25, 2026 - 22:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created API token.

AnalysisAI

Broken access control in GazellePW's API user endpoint permits any authenticated user holding a standard API token to enable or disable arbitrary user accounts - including administrator accounts - via the req=disable or req=enable action parameters. Affected is GazellePW at commit 86c4bedf727691b5a97af42a4864869d18446449. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid, active GazellePW user account and the ability to generate a standard user API token - both default capabilities for registered members. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS score of 4.3 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) captures the standalone vulnerability conservatively - exploitation is network-accessible and low-complexity but requires a valid authenticated account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch or fixed commit has been identified in the provided data; patch status is unconfirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.