B3log Symphony EUVD-2026-98938

No authentication, user interaction, or special configuration is required: per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) and description, any unauthenticated attacker who can reach the Symphony web interface can exploit this against default deployments running version 3.6.4 or earlier. The specific precondition is that the targeted admin route lacks a permission.rule.url entry, which PermissionMidware.check then treats as permitted - this is a code-level default, not an operator misconfiguration. Limiting factors: the attacker must be able to reach the admin HTTP endpoints (network exposure of the Symphony instance), the issue is fixed in versions after 3.6.4, and impact is confined to integrity-only abuse actions (point grants, tag deletion, report suppression) with no confidentiality or availability effect.

This is a genuine but moderate-severity access-control flaw, not a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms it is remotely reachable by unauthenticated attackers with low complexity and no user interaction - the worst-case exposure profile for those metrics. However, impact is deliberately scoped low: only VI:L (integrity) is set, with VC:N and VA:N, meaning no data disclosure and no availability loss. The affected admin actions (ignoring abuse reports, deleting unused tags, granting user points without audit logging) are integrity/abuse-of-function issues rather than code execution or full account takeover, which is why the score lands at 6.9 (Medium). No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was supplied in the inputs - though a HackMD technical writeup and a VulnCheck advisory exist, raising the likelihood that a working request is easy to reproduce from the documented endpoints. The signals are internally consistent (network vector matches the HTTP admin-route description; low privileges match the 'unauthenticated' claim), so there is no conflict to flag - but absent EPSS/KEV data, real-world exploitation volume is unknown and should be treated as plausible-but-unmeasured given the trivial reproducibility.

An unauthenticated attacker enumerates the Symphony admin console and issues a direct HTTP request to an admin route that lacks a permission.rule.url entry - for example /admin/user/{userId}/init-point to grant points, /admin/tags/remove-unused to delete tags, or /admin/report/ignore/{reportId} to suppress abuse reports. Because PermissionMidware.check permits routes with no registered rule, the request succeeds without authentication and without generating an audit log entry. No public exploit code was provided, but the attack is a trivial single crafted request given the documented endpoints.