CVE-2026-5749

High

Published: 22/04/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Fullstep V5, inadequate access control in the registration process could allow unauthenticated users to obtain a valid JWT token to interact with authenticated API resources.

Risk Assessment

Successful exploitation of this vulnerability could allow an unauthenticated attacker to compromise the confidentiality of the affected resource, provided they have a valid token to interact with the API.

Recommendation

It is recommended to implement appropriate access control mechanisms in the registration process to prevent unauthorized users from obtaining JWT tokens.

Other vulnerabilities in Fullstep V5

CVE-2026-5750High
An IDOR vulnerability in the Fullstep V5 registration process allows authenticated users to access data belonging to other registered users through vulnerable authenticated resources. The vulnerable endpoints include '/api/suppliers/v1/suppliers//false' to list user information and '/#/supplier-registration/supplier-registration//2' to update user information.

Original NVD description (English source)

Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain a valid JWT token with which to interact with authenticated API resources. Successful exploitation of this vulnerability could allow an unauthenticated attacker to compromise the confidentiality of the affected resource, provided they have a valid token with which to interact with the API.