CyberRota Analysis
AI-GeneratedThe vulnerability in sysPass version 3.2.11 allows API token holders to bypass object-level authorization, enabling unauthorized access to account metadata, password overwrites, and account deletions across the vault. This flaw can be exploited by attackers to manipulate accounts without proper access controls, posing a significant risk to user data integrity and security. Organizations using this version of sysPass should prioritize immediate remediation to mitigate potential account compromise and data loss.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions.