CVE-2026-74877
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
openssl_encrypt before version 1.4.0 contains a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction.
Risk Assessment
The risk includes unauthorized revocation of other users' keys, potentially leading to service disruption and system integrity compromise.
Recommendation
It is recommended to upgrade openssl_encrypt to version 1.4.0 or later, which includes a fix enforcing ownership verification before key revocation.
Original NVD description (English source)
openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction.