CVE-2026-76876

Katalog CVE

CVSS 5.9 · Medium EPSS 0,45%

Kerentanan Missing Authorization. Skor CVSS 3.1 5.9 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.

Rincian

Terbit di NVD

21 Agustus 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Deferred

CVSS 3.1

5.9 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 36,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/puemos/craftplan/commit/317acd584b68887f592dc3b97f47703dd63b1bf
• https://github.com/puemos/craftplan/releases/tag/v0.5.1
• https://www.vulncheck.com/advisories/craftplan-broken-access-control-information-disclosure-via-settings-api