CVE-2026-76876
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.
Risk Assessment
The risk includes unauthorized access to sensitive credentials, which can lead to compromise of email accounts or other services. The attack does not require authentication.
Recommendation
It is recommended to immediately update Craftplan to version 0.5.1 or later. Also, review logs for unauthorized requests to the settings API.
Other vulnerabilities in Craftplan
Original NVD description (English source)
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS