CVE-2026-65708
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Insecure direct object reference vulnerability in sysPass up to version 3.2.11, allowing any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for.
Risk Assessment
An attacker can enumerate and manipulate any attachments in the vault, bypassing account-level access controls.
Recommendation
Update sysPass to a version containing the fix or implement proper authorization checks.
Other vulnerabilities in sysPass
See all- CVE-2026-63725High
sysPass in FileBackupService::doBackupFiles() builds a tar command by concatenating the backup directory path without escapeshellarg() and without character validation. An administrator (or an attacker with an API token) can store a path containing shell metacharacters, and when a backup is triggered, arbitrary OS commands can be executed as the web server user. This can lead to reading the master password and encryption key, decrypting all stored passwords, and compromising the system.
- CVE-2026-65711High
OS command injection vulnerability in sysPass up to version 3.2.11, allowing authenticated administrators to execute arbitrary commands by setting a malicious backup path and triggering a backup.
- CVE-2026-65710High
Missing authorization vulnerability in sysPass up to version 3.2.11, allowing authenticated users with the PUBLICLINK_CREATE flag to trigger unauthorized decryption and persistent storage of any vault account's password.
- CVE-2026-65709High
Missing object-level authorization in the JSON-RPC API in sysPass up to version 3.2.11, allowing API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control.
Original NVD description (English source)
sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions to enumerate and manipulate any attachment in the vault, bypassing account-level access controls entirely.