{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/syspass--3.2.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-65709"},{"cvss":7.2,"id":"CVE-2026-65711"},{"cvss":7.1,"id":"CVE-2026-65710"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sysPass (\u003c= 3.2.11)","sysPass \u003c= 3.2.11"],"_cs_severities":["high"],"_cs_tags":["sysPass","vulnerability","authorization-bypass","api-exploitation","cve","missing-authorization","credential-disclosure","web-application"],"_cs_type":"advisory","_cs_vendors":["sysPass"],"content_html":"\u003cp\u003esysPass, an open-source password manager, through version 3.2.11 is vulnerable to a critical missing object-level authorization flaw (CVE-2026-65709) in its JSON-RPC API. This vulnerability allows an attacker who has acquired any API token, even one with limited permissions, to bypass intended access controls. By directly invoking \u003ccode\u003eAccountController\u003c/code\u003e methods such as \u003ccode\u003eviewAction\u003c/code\u003e, \u003ccode\u003eeditAction\u003c/code\u003e, \u003ccode\u003edeleteAction\u003c/code\u003e, and \u003ccode\u003eeditPassAction\u003c/code\u003e, the attacker can perform unauthorized actions across the entire sysPass vault. This includes enumerating metadata for all accounts, overwriting any user's password, and deleting any account, completely disregarding the \u003ccode\u003eAccountFilterUser\u003c/code\u003e checks that should enforce per-account permissions. This vulnerability significantly impacts the confidentiality, integrity, and availability of sensitive credentials managed by sysPass instances.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access - API Token Acquisition\u003c/strong\u003e: An attacker obtains a legitimate, but potentially low-privileged, API token for a sysPass instance through various means (e.g., compromise of a less critical user account, sniffing network traffic, misconfiguration).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eJSON-RPC API Interaction\u003c/strong\u003e: The attacker sends specially crafted JSON-RPC requests to the sysPass API endpoint, targeting the \u003ccode\u003eAccountController\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTargeting Unauthorized Methods\u003c/strong\u003e: The requests specifically invoke \u003ccode\u003eAccountController\u003c/code\u003e methods like \u003ccode\u003eviewAction\u003c/code\u003e, \u003ccode\u003eeditAction\u003c/code\u003e, \u003ccode\u003edeleteAction\u003c/code\u003e, or \u003ccode\u003eeditPassAction\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthorization Bypass\u003c/strong\u003e: Due to CVE-2026-65709, the sysPass application fails to enforce \u003ccode\u003eAccountFilterUser\u003c/code\u003e checks, allowing the API token to operate outside its assigned scope.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAccount Enumeration\u003c/strong\u003e: By successfully invoking \u003ccode\u003eviewAction\u003c/code\u003e without proper authorization, the attacker can enumerate metadata for any account in the sysPass vault, performing unauthorized reconnaissance.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePassword Overwrite\u003c/strong\u003e: Leveraging the \u003ccode\u003eeditPassAction\u003c/code\u003e method, the attacker can overwrite passwords for any user account within the vault, gaining unauthorized access to those accounts.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAccount Modification/Deletion\u003c/strong\u003e: The attacker can use \u003ccode\u003eeditAction\u003c/code\u003e to modify account details or \u003ccode\u003edeleteAction\u003c/code\u003e to remove accounts entirely, leading to data manipulation or denial of service.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFull Vault Compromise\u003c/strong\u003e: Through these actions, the attacker achieves a full compromise of user accounts and sensitive information stored within the sysPass vault, bypassing all intended access controls.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65709 leads to a complete compromise of the sysPass vault. Attackers can enumerate all account metadata, gain unauthorized access to any user account by overwriting passwords, and disrupt operations by deleting accounts. This results in severe data breaches, loss of critical credentials, and potential denial of service, affecting all users and systems whose credentials are managed by the vulnerable sysPass instance. The vulnerability bypasses fine-grained access controls, rendering existing token permissions ineffective against a determined attacker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-65709 immediately by upgrading sysPass to version 3.2.12 or newer to address the missing object-level authorization vulnerability.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for any suspicious JSON-RPC API calls to \u003ccode\u003eAccountController\u003c/code\u003e methods (\u003ccode\u003eviewAction\u003c/code\u003e, \u003ccode\u003eeditAction\u003c/code\u003e, \u003ccode\u003edeleteAction\u003c/code\u003e, \u003ccode\u003eeditPassAction\u003c/code\u003e) that appear to originate from API tokens with insufficient permissions.\u003c/li\u003e\n\u003cli\u003eImplement strict network segmentation and firewall rules to limit direct access to the sysPass JSON-RPC API endpoint only to trusted internal sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T17:19:50Z","date_published":"2026-07-24T17:18:52Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-65709-syspass/","summary":"sysPass versions up to 3.2.11 are affected by a missing object-level authorization vulnerability in the JSON-RPC API. Attackers holding an API token can exploit this flaw by invoking AccountController methods (e.g., viewAction, editAction, deleteAction, editPassAction) without proper AccountFilterUser checks, allowing them to enumerate account metadata, overwrite passwords, and delete user accounts across the entire vault, bypassing per-account access control defined by their token permissions.","title":"CVE-2026-65709 - sysPass JSON-RPC API Missing Object-Level Authorization","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-65709-syspass/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-65708"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sysPass \u003c= 3.2.11"],"_cs_severities":["high"],"_cs_tags":["idor","access-control-bypass","web-application","data-exfiltration"],"_cs_type":"advisory","_cs_vendors":["sysPass"],"content_html":"\u003cp\u003eA critical insecure direct object reference (IDOR) vulnerability, identified as CVE-2026-65708, has been discovered in sysPass versions up to and including 3.2.11. This flaw enables any authenticated attacker to bypass account-level access controls within the application. By exploiting missing authorization checks in the \u003ccode\u003eAccountFileController\u003c/code\u003e, attackers can manipulate specific numeric file IDs when performing actions such as downloading, viewing, deleting, uploading, or listing attachments. This allows them to access, enumerate, and manipulate any file attachment stored in the sysPass vault, regardless of their assigned permissions for the associated accounts. This vulnerability significantly compromises data confidentiality and integrity by allowing unauthorized access to sensitive information.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated attacker logs into the sysPass application with valid user credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP request targeting the \u003ccode\u003eAccountFileController\u003c/code\u003e component, attempting an action like \u003ccode\u003edownload\u003c/code\u003e, \u003ccode\u003eview\u003c/code\u003e, \u003ccode\u003edelete\u003c/code\u003e, \u003ccode\u003eupload\u003c/code\u003e, or \u003ccode\u003elist\u003c/code\u003e an account file attachment.\u003c/li\u003e\n\u003cli\u003eInstead of providing a legitimate file ID associated with their authorized accounts, the attacker supplies an arbitrary numeric file ID in the request parameters.\u003c/li\u003e\n\u003cli\u003eDue to missing authorization checks in the \u003ccode\u003eAccountFileController\u003c/code\u003e, the application processes the request for the supplied arbitrary file ID without verifying the attacker's access permissions for the associated account.\u003c/li\u003e\n\u003cli\u003eThe sysPass application serves the requested attachment, allows its deletion, or permits other specified manipulation, effectively bypassing the intended account-level access controls.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully accesses, enumerates, or manipulates account file attachments belonging to accounts they do not have legitimate permissions for.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65708 results in unauthorized access to sensitive data stored in sysPass file attachments. Attackers can view, download, modify, or delete any file attachment within the system, leading to severe data breaches, loss of sensitive information, or data corruption. This impacts the confidentiality and integrity of all data stored in sysPass attachments across an organization, potentially exposing credentials, financial documents, or other critical business assets. The vulnerability's CVSS v3.1 base score of 8.1 highlights its significant risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-65708 immediately by upgrading sysPass to a version greater than 3.2.11.\u003c/li\u003e\n\u003cli\u003eImplement strict authorization checks for all file-related operations within the \u003ccode\u003eAccountFileController\u003c/code\u003e to ensure that only authorized users can access specific file IDs.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for repeated or unusual requests to sysPass \u003ccode\u003eAccountFileController\u003c/code\u003e endpoints (e.g., \u003ccode\u003edownload\u003c/code\u003e, \u003ccode\u003eview\u003c/code\u003e, \u003ccode\u003edelete\u003c/code\u003e, \u003ccode\u003eupload\u003c/code\u003e, \u003ccode\u003elist\u003c/code\u003e actions) that involve varying or non-sequential file IDs, especially from single authenticated users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T17:18:13Z","date_published":"2026-07-24T17:18:13Z","id":"https://feed.craftedsignal.io/briefs/2026-07-syspass-idor/","summary":"An insecure direct object reference vulnerability (CVE-2026-65708) in sysPass versions up to 3.2.11 allows authenticated attackers to bypass access controls, accessing, enumerating, and manipulating account file attachments by manipulating numeric file IDs in `AccountFileController` actions without proper authorization checks, leading to unauthorized data access.","title":"sysPass Insecure Direct Object Reference Vulnerability (CVE-2026-65708)","url":"https://feed.craftedsignal.io/briefs/2026-07-syspass-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - SysPass \u003c= 3.2.11","version":"https://jsonfeed.org/version/1.1"}