CVE-2026-1213

Katalog CVE

CVSS 4.3 · Medium EPSS 0,36%

Kerentanan Authorization Bypass Through User-Controlled Key pada askbot. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2.

Rincian

Terbit di NVD

27 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ASKBOT/askbot-devel/commit/3da3d75f35204aa71633c7a315327ba39cb6295d patch
• https://fluidattacks.com/advisories/ghost exploit · advisory pihak ketiga
• https://askbot.com/ product