Shizenbox2 Edge App
Monthly
Authorization bypass in ShizenBox2 edge-app (versions ≤ v3.1.15) permits any authenticated low-privilege user to change another account's password by supplying a manipulated user-controlled key in the password-change request - a classic Insecure Direct Object Reference (IDOR) pattern classified under CWE-639. The CVSS 4.0 vector (PR:L/VI:H) confirms that exploitation requires only a valid login with no elevated permissions or user interaction, yielding a high integrity impact against targeted accounts. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; a vendor advisory has been published through JPCERT/JVN.
Authorization bypass in ShizenBox2 edge-app (versions ≤ v3.1.15) permits any authenticated low-privilege user to change another account's password by supplying a manipulated user-controlled key in the password-change request - a classic Insecure Direct Object Reference (IDOR) pattern classified under CWE-639. The CVSS 4.0 vector (PR:L/VI:H) confirms that exploitation requires only a valid login with no elevated permissions or user interaction, yielding a high integrity impact against targeted accounts. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; a vendor advisory has been published through JPCERT/JVN.