CVE-2026-65709

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65709
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65709.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65709
Published
2026-07-24T15:59:26.627Z
Modified
2026-07-28T03:56:02.185328469Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API
Details

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65709.json",
    "cwe_ids": [
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/nuxsmin/syspass

Affected ranges

Type
GIT
Repo
https://github.com/nuxsmin/syspass
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9d0e169d2163897238877fb65130db47fe1ddcfa
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.2.11"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.2.18
1.1.2.19
1.1.2.20
1.1.2.21
1.1.2.22
1.1.2.23
1.1.2.24
1.2.0.02-rc2
1.2.0.03-rc3
1.2.0.04-rc4
1.2.0.05-rc5
1.2.0.06
1.2.0.07
1.2.0.08
1.2.0.09
1.2.0.10
1.2.0.11
1.2.0.12
1.2.0.13
1.2.0.14
1.2.0.16
1.2.0.17
1.2.0.18
1.2.0.19
1.2.0.20
1.2.0.21
2.*
2.0.0.17021301
2.0.0.17021302
2.0.0.17021601
2.1.0.17022601
2.1.0.17030201
2.1.1.17030601
2.1.10.17053003
2.1.11.17061503
2.1.12.17080701
2.1.13.17083101
2.1.14.17090101
2.1.15.17101701
2.1.16.18061901
2.1.2.17031401
2.1.3.17031601
2.1.4.17032801
2.1.5.17041201
2.1.6.17041401
2.1.7.17042101
2.1.8.17042901
2.1.9.17050401
3.*
3.0.0.18126201
3.0.1
3.0.1.19012002
3.1.0.19042801-rc1
3.1.0.19043001-rc2
3.1.0.19052502-rc3
3.1.0.19052503-rc4
3.1.0.19072001-rc5
3.1.0.19081801
3.1.1.19121601
3.1.2.20030701
3.2.0
3.2.1
3.2.10
3.2.11
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65709.json"