EUVD-2026-70253
GHSA-3qwp-5cgc-v46r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth or interaction; impact limited to disclosure of admin UI structure, not direct data or credential exfiltration.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.1 can resolve this issue. It is suggested to upgrade the affected component.
AnalysisAI
Missing server-side authentication on all 17 admin and DPO compliance console pages in tsi-dpdp-cms ≤0.5.0 allows any unauthenticated network client to retrieve complete console page source, including internal API endpoint paths, function names, and request schemas. The root cause is exclusive reliance on client-side JavaScript redirects as the sole access gate - a plain curl request to any console URL receives full page content with no credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for the console-page disclosure: exploitation targets default deployments of tsi-dpdp-cms ≤0.5.0 exposed to any network-reachable HTTP client with no credentials, no user interaction, and no non-default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/E:P) and score of 6.9 reflect a remotely exploitable, no-interaction information disclosure with a public POC. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to tsi-dpdp-cms v0.5.1, which introduces server-side session validation for all 17 admin and DPO console pages via a new login cookie independent of the existing API bearer token, and adds a deployment-configured TSI_BOOTSTRAP_TOKEN to protect the super-admin setup endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Tsi Dpdp Cms
View allUnauthenticated access to the first-run Super-Admin bootstrap endpoint (/api/v1/bootstrap/setup) and all 17 admin/DPO co
Missing server-side authentication in tsi-coop tsi-dpdp-cms ≤0.5.0 exposes all 17 admin and DPO console pages to unauthe
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today