Skip to content
Threat Feed

Tag

Cve-2026-5652

1 brief RSS
critical advisory

Crafty Controller Users API Insecure Direct Object Reference Vulnerability

Crafty Controller's Users API component contains an insecure direct object reference vulnerability, allowing a remote, authenticated attacker to perform unauthorized user modification actions due to improper API permissions validation (CVE-2026-5652).

idor privilege-escalation cve-2026-5652
2r 1t 1c 1i