CVE-2026-57951

Katalog CVE

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Incorrect Authorization pada its-a-feature mythic. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payload_build_step to read step_stdout, step_stderr, step_name, and step_description across all operations on the server.

Rincian

Terbit di NVD

29 Juni 2026

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/its-a-feature/Mythic/commit/82648e8241b800a32e1882afc310e7316d98ebaa patch
• https://www.vulncheck.com/advisories/mythic-broken-permission-filter-in-payload-build-step-table advisory pihak ketiga
• https://github.com/its-a-feature/Mythic/issues/563 issue tracking
• https://github.com/its-a-feature/Mythic/releases/tag/v3.4.0.60 release notes