CVE-2026-108810
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Information disclosure vulnerability in tsi-coop tsi-dpdp-cms versions 0.5.0/0.5.1/0.5.2 in the JSON Schema Validation component. Manipulation of the _func argument leads to information disclosure, remotely exploitable.
Risk Assessment
An attacker can remotely access sensitive information, potentially leading to confidentiality breaches. Upgrade to version 0.5.3 is recommended.
Recommendation
Upgrade tsi-dpdp-cms to version 0.5.3 or later, which includes the fix. Restrict access to sensitive functions.
Other vulnerabilities in tsi-dpdp-cms
See all- CVE-2026-84841High
A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. It affects unknown code, and the manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released publicly. Upgrading to version 0.5.1 resolves the issue.
- CVE-2026-84840Medium
A vulnerability was identified in tsi-coop tsi-dpdp-cms up to version 0.5.0 in the file InterceptingFilter.java of the Bootstrap Setup Endpoint component. Manipulation leads to missing authentication. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-84839Medium
A vulnerability was found in tsi-coop tsi-dpdp-cms up to version 0.5.0 in the file web.xml of the Admin Console/DPO Compliance Console component. Executing a manipulation leads to missing authentication. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument _func results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.3 is recommended to address this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS