CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 8.8. Exploitation may require the attacker to be authenticated.
CVE
CVE-2026-23754
Severity
HIGH
CVSS
8.8
EPSS
0.32%
Original NVD Description
D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credential material can be reused directly as a valid authentication secret, allowing full impersonation of the targeted account. This results in complete account takeover and full administrative control over the D-View system.
Related CVEs
Other vulnerabilities affecting the same vendor(s)