CVE-2026-5794

MediumCVSS 4.9

Published: 28/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another from logging in by triggering an account lockout via a specially crafted request. This can lead to denial of access for the victim.

Risk Assessment

A malicious user could lock out other users' accounts, causing work disruption and potential operational impact. This may be used for account-level denial-of-service attacks.

Recommendation

Apply the vendor fix for Cryptobox that eliminates the ability to trigger account lockout via crafted requests. Consider rate limiting and monitoring of lockout attempts.

Other vulnerabilities in Cryptobox

CVE-2026-6805High
The vulnerability in the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server, enabling an offline brute-force attack on the access code associated with this sharing link.

Original NVD description (English source)

A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specially crafted request.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS