EUVD-2026-69413
GHSA-7j79-fp44-8grh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed instance over network
-
DeliveryRequest admin configuration endpoint
-
ExploitRead leaked authTokenKey
-
ExecutionForge valid admin auth token
-
PersistAuthenticate as administrator
-
ImpactFull data access and account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the fast-note-sync-service admin configuration endpoint on a vulnerable instance (<=2.13.7); the CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is needed to retrieve the exposed authTokenKey. The realistic limiting factors are exposure and footprint rather than technique: the admin/config endpoint must be network-accessible to the attacker (instances gated behind a VPN, authenticating proxy, or IP allowlist are not directly reachable), and the product is a niche self-hosted application, so the pool of exposed targets is small. Full compromise depends on the exposed authTokenKey actually being the token-signing secret, which the description implies. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is defensible: a remotely reachable endpoint discloses a signing key with no authentication, and key disclosure realistically chains to token forgery yielding full confidentiality, integrity, and availability impact over the application. Signals diverge, however: EPSS is only 0.21% (11th percentile) and there is no CISA KEV listing, indicating no evidence of widespread automated exploitation. This is a genuinely high-severity, easy-to-exploit bug on paper, but the low deployment footprint of an obscure self-hosted project (rather than any weakness in the flaw itself) is what keeps real-world mass-exploitation probability low. Note the impact chain (I:H/A:H) is inferred from the consequence of key disclosure/token forgery rather than stated explicitly in the description - the direct primitive is information exposure. |
| Exploit ScenarioDerived | An attacker who can reach the service over the network sends a request to the admin configuration endpoint and reads back the authTokenKey in the response, requiring no credentials. Using that secret, the attacker forges a valid administrative authentication token and gains full control over the note-sync instance and its stored data. A researcher gist and GitHub issue are referenced and likely provide proof-of-concept steps, lowering the practical barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Privilege escalation in haierkeys fast-note-sync-service versions 2.13.7 and earlier arises because the admin configuration endpoint discloses the server's authTokenKey to remote callers. Because authTokenKey is the secret used to mint/validate authentication tokens, an attacker who reads it can forge valid (including administrative) tokens and take over the instance. No active exploitation is recorded in CISA KEV and EPSS is low (0.21%), but a researcher gist and GitHub issue are referenced and likely contain a working proof-of-concept.
RemediationAI
No vendor-released fixed version is identified in the available data, so no exact patch version can be cited; monitor the project's GitHub repository and issue #268 (https://github.com/haierkeys/fast-note-sync-service/issues/268) for a tagged release beyond 2.13.7 and upgrade once published. As compensating controls until a patch ships: restrict network reachability of the admin/configuration endpoint via a reverse proxy or firewall so only trusted management IPs can reach it (trade-off: breaks remote admin from untrusted networks); place the service behind an authenticating proxy/VPN if the endpoint cannot otherwise be gated; and after any suspected exposure rotate the authTokenKey and invalidate all issued tokens, since a leaked key must be assumed compromised (trade-off: forces all clients to re-authenticate). Review the researcher gist (https://gist.github.com/L4wCat/924c10c36d6d11651049787d547d411b) to confirm the exact vulnerable route to block.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
fast-note-sync-service is an open-source, self-hosted Go-based backend that synchronizes notes (e.g., an Obsidian-style sync server) developed by GitHub user haierkeys. The flaw is CWE-284 (Improper Access Control): a configuration/admin endpoint that should be restricted returns sensitive server configuration, specifically the authTokenKey - the signing/secret key underpinning the token-based authentication scheme. Once this key is exposed, the entire session/token trust model collapses, since token integrity depends on the key remaining secret. The CPE is the placeholder 'cpe:2.3:a:n/a:n/a:*', so exact affected-product identification must come from the GitHub project rather than NVD's CPE data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable endpoint leaks the token-signing key (PR:N/AC:L), enabling token forgery and full application takeover, so C/I/A all High.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey
Executive ViewAI
The haierkeys fast-note-sync-service (versions 2.13.7 and earlier) contains a critical vulnerability allowing unauthenticated remote attackers to obtain authentication token secrets from an improperly-secured endpoint and forge administrative credentials; publicly available exploit code exists. Organizations running this service face immediate risk of unauthorized administrative access and complete data compromise. Urgent remediation is required, as no vendor patch is currently available.
Isolate the service via network segmentation and firewall rules restricting access to trusted internal networks; disable the service entirely if not operationally critical; implement Web Application Firewall rules blocking requests to the admin configuration endpoint; enable real-time monitoring and alerting on authentication token creation events and administrative actions; maintain secure offline backups independent of the compromised service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB