CVE-2026-65709
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Missing object-level authorization in the JSON-RPC API in sysPass up to version 3.2.11, allowing API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control.
Risk Assessment
An attacker can modify or delete accounts beyond token permissions, potentially leading to data integrity breaches.
Recommendation
Update sysPass to a version containing the fix or implement proper object-level access controls.
Other vulnerabilities in sysPass
See all- CVE-2026-63725High
sysPass in FileBackupService::doBackupFiles() builds a tar command by concatenating the backup directory path without escapeshellarg() and without character validation. An administrator (or an attacker with an API token) can store a path containing shell metacharacters, and when a backup is triggered, arbitrary OS commands can be executed as the web server user. This can lead to reading the master password and encryption key, decrypting all stored passwords, and compromising the system.
- CVE-2026-65711High
OS command injection vulnerability in sysPass up to version 3.2.11, allowing authenticated administrators to execute arbitrary commands by setting a malicious backup path and triggering a backup.
- CVE-2026-65710High
Missing authorization vulnerability in sysPass up to version 3.2.11, allowing authenticated users with the PUBLICLINK_CREATE flag to trigger unauthorized decryption and persistent storage of any vault account's password.
- CVE-2026-65708High
Insecure direct object reference vulnerability in sysPass up to version 3.2.11, allowing any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for.
Original NVD description (English source)
sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions.