Vulnerability details
CVE-2026-65708
nuxsmin sysPass
sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController
CVSS 4.0
8.6High
Official description
sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions to enumerate and manipulate any attachment in the vault, bypassing account-level access controls entirely.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| nuxsmin | sysPass | v ≤ 3.2.11 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://github.com/Caycon/cve-advisories/blob/main/2026/sysPass/CVE-2026-65708.md technical-descriptionexploit
- https://www.vulncheck.com/advisories/syspass-insecure-direct-object-reference-via-accountfilecontroller third-party-advisory
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-24
- Last updated
- 2026-07-28
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.38%
Probability of exploitation in 30 days
32.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-639Authorization Bypass Through User-Controlled Key