CVE-2026-23754
HighSummary
D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value to retrieve sensitive credential data belonging to other users, including super administrators, allowing full impersonation and account takeover.
Risk Assessment
Risk of complete account takeover and full administrative control over the D-View system, potentially leading to data integrity and confidentiality breaches.
Recommendation
Upgrade D-Link D-View 8 to a version newer than 2.0.1.107 and implement proper authorization mechanisms.
Other vulnerabilities in D-Link D-View 8
Original NVD description (English source)
D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credential material can be reused directly as a valid authentication secret, allowing full impersonation of the targeted account. This results in complete account takeover and full administrative control over the D-View system.