CVE-2026-8077

High

Published: 08/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. An attacker could modify the binary string in the 'Permissions' field of the JSON response, allowing privilege escalation and full administrative access.

Risk Assessment

The lack of authorization controls in the backend exposes the system to unauthorized access, potentially leading to complete compromise of system management.

Recommendation

It is recommended to implement proper authorization mechanisms in the backend and review and update the system to the latest version to minimize the risk of privilege escalation.

Other vulnerabilities in CashDro 3 web administration panel, version 24.01.00.26

CVE-2026-8076Critical
The CashDro 3 web administration panel version 24.01.00.26 has weak credentials as it allows the use of numeric PINs for user authentication. An attacker can easily perform a brute-force attack by trying different PINs without the account being locked.

Original NVD description (English source)

Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. The backend lacks authorization controls, leaving security entirely to the frontend. By modifying the binary string in the ‘Permissions’ field of the JSON response, an attacker could escalate privileges and gain full administrative access. This vulnerability allows all restrictions to be bypassed and completely compromises system management.