CVE-2026-5779

High

Published: 28/04/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An IDOR vulnerability in MphRx Minerva V3.6.0, specifically in the '/minerva/user/updateUserProfile' endpoint, allows an authenticated user to modify the information of other registered users. Exploiting this vulnerability enables changing data such as email addresses and requesting a new password.

Risk Assessment

Exploitation of this vulnerability could lead to account takeover by unauthorized users, posing a serious threat to data security within the organization.

Recommendation

It is recommended to implement additional authorization mechanisms and data validation in endpoints to prevent unauthorized modifications of user information.

Other vulnerabilities in MphRx Minerva V3.6.0

CVE-2026-5781High
An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/moUser/update' endpoint, allows an authenticated user with user modification privileges to escalate their privileges by sending an HTTP request with a manipulated 'identifier' field. Successful exploitation could allow an authenticated user to obtain administrator privileges.

Original NVD description (English source)

An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/user/updateUserProfile' endpoint. This allows an authenticated user to modify the information of other registered users. Successful exploitation of this vulnerability allows an authenticated user to modify other users' information, such as their email address, and request a new password via the '/webconnect/#/forgotPassword' endpoint. This could lead to complete account takeover.