CVE-2026-28155
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Unauthenticated Insecure Direct Object References (IDOR) vulnerability in Do Lasso up to version 358 allows an unauthenticated attacker to access objects without authorization.
Risk Assessment
Unauthenticated attackers may access sensitive data or functions, potentially leading to confidentiality breaches.
Recommendation
Update Do Lasso to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Do Lasso
See all- CVE-2026-28158High
Unauthenticated Cross Site Scripting (XSS) in Do Lasso versions up to 358. An attacker can inject malicious script without authentication.
- CVE-2026-28157High
Path Traversal vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows access to files outside the root directory.
- CVE-2026-28156High
SQL Injection vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows manipulation of database queries.
Original NVD description (English source)
Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS