CVE-2026-65710
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Missing authorization vulnerability in sysPass up to version 3.2.11, allowing authenticated users with the PUBLICLINK_CREATE flag to trigger unauthorized decryption and persistent storage of any vault account's password.
Risk Assessment
An attacker can access passwords of all accounts in the vault, potentially leading to data confidentiality breaches.
Recommendation
Update sysPass to a version containing the fix or implement proper access controls.
Other vulnerabilities in sysPass
See all- CVE-2026-63725High
sysPass in FileBackupService::doBackupFiles() builds a tar command by concatenating the backup directory path without escapeshellarg() and without character validation. An administrator (or an attacker with an API token) can store a path containing shell metacharacters, and when a backup is triggered, arbitrary OS commands can be executed as the web server user. This can lead to reading the master password and encryption key, decrypting all stored passwords, and compromising the system.
- CVE-2026-65711High
OS command injection vulnerability in sysPass up to version 3.2.11, allowing authenticated administrators to execute arbitrary commands by setting a malicious backup path and triggering a backup.
- CVE-2026-65709High
Missing object-level authorization in the JSON-RPC API in sysPass up to version 3.2.11, allowing API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control.
- CVE-2026-65708High
Insecure direct object reference vulnerability in sysPass up to version 3.2.11, allowing any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for.
Original NVD description (English source)
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINK_CREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the public link creation flow. Attackers can invoke the saveCreateFromAccountAction endpoint to cause AccountService::getDataForLink to load arbitrary target accounts without AccountFilterUser restrictions, decrypt credentials using the session master key, and serialize cleartext passwords into Vault storage on the PublicLink database row, enabling subsequent unauthenticated retrieval if the generated link hash is recovered.