CVE-2026-3739

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-3739

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3739.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-3739

Aliases

GHSA-7476-6crq-4cw9

Published

2026-03-08T14:02:09.949Z

Modified

2026-07-15T01:49:18.043668293Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication

Details

A security flaw has been discovered in suitenumerique messages 0.2.0. This issue affects the function ThreadAccessSerializer of the file src/backend/core/api/serializers.py of the component ThreadAccess. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.3.0 is capable of addressing this issue. The patch is identified as d7729f4b885449f6dee3faf8b5f2a05769fb3d6e. The affected component should be upgraded.

Database specific

{
    "cwe_ids": [
        "CWE-287"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3739.json"
}

References

Affected packages

Git / github.com/suitenumerique/messages

Affected ranges

Type

GIT

Repo

https://github.com/suitenumerique/messages

Events

Introduced

25e28cf69dc99918fefcf719e64ba292225db40b

Fixed

d7729f4b885449f6dee3faf8b5f2a05769fb3d6e

Fixed

eb58da7cf21f8c1e5068e7d1a311b4acc4b38358

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.2.0"
        },
        {
            "last_affected": "0.2.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.2.0

v0.*

v0.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3739.json"