CVE-2026-128970
- Source
- https://cve.org/CVERecord?id=CVE-2026-128970
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128970.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-128970
- Published
- 2026-11-13T14:25:45Z
- Modified
- 2026-11-14T02:47:33Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
- Summary
- Missing membership acceptance check permits group share-right deletion by invitees in Psono Server
- Details
-
Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the authenticated user, and share_admin=True, but omits accepted=True. An authenticated remote attacker who has been invited to a group with share-admin privileges, and who knows a group share-right UUID, can therefore delete that group's share-right record without accepting the invitation or after declining it. Pending invitations have accepted=None, while declined invitations retain accepted=False and the share_admin flag. Deletion revokes the group's access to the affected share and its contained secrets for all accepted group members, without deleting the underlying data or disclosing secret contents. The issue was fixed in version 7.5.1 of both editions, released on 2026-10-13.
- Database specific
{ "cna_assigner": "esaqa", "cwe_ids": [ "CWE-863" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128970.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128970.json
- https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-128970.md
- https://gitlab.com/esaqa/psono/psono-server
- https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.5.0/psono/restapi/serializers/create_share_right.py
- https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.5.0/psono/restapi/serializers/delete_share_right.py
- https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.5.0/psono/restapi/views/membership_decline.py
- https://gitlab.com/esaqa/psono/psono-server/-/commit/11f9aa69dae370cd4f0213f4d03d1b1cc4df36dd
- https://gitlab.com/esaqa/psono/psono-server/-/commit/86e7ce7fdbb04fc4ae3430cc434179630948d48d
- https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.5.1
- https://nvd.nist.gov/vuln/detail/CVE-2026-128970
Affected packages
Git / gitlab.com/esaqa/psono/psono-server
Affected ranges
- Type
- GIT
- Repo
- https://gitlab.com/esaqa/psono/psono-server
- Events
-
IntroducedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.12.6" }, { "fixed": "7.5.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "0" }, { "fixed": "7.5.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "86e7ce7fdbb04fc4ae3430cc434179630948d48d" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "11f9aa69dae370cd4f0213f4d03d1b1cc4df36dd" } ], "source": "REFERENCES_COMMIT" } ] }