CVE-2026-108810 Details
Description
A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument _func results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.3 is recommended to address this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A vulnerability exists in TSI Coop TSI DPDP CMS versions 0.5.0, 0.5.1, and 0.5.2, where the API dispatcher validates request payloads against JSON schema before checking authentication. This flaw allows unauthenticated attackers to send POST requests with valid '_func' values while omitting required fields, resulting in the server disclosing names of the missing fields via a 400 error response. This information can be used to map the internal API parameter schema for various '_func' operations, including those related to job and API key management, without any credentials. The vulnerability has been exploited publicly, but has been addressed in version 0.5.3.
Upgrade to TSI DPDP CMS version 0.5.3. This version fixes the vulnerability by ensuring that authentication checks are performed before payload validation, preventing the disclosure of field names in error responses for unauthenticated requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kavinkumarst/TSI-DPDP-CMS-API-Parameter-Schema-Enumerable-Without-Authentication/blob/main/README.md | [email protected] | ExploitTechnical Description |
| https://github.com/tsi-coop/tsi-dpdp-cms/ | [email protected] | ProductVendor |
| https://github.com/tsi-coop/tsi-dpdp-cms/blob/v0.5.3/docs/security-fixes/4.md | [email protected] | Technical AnalysisVendor |
| https://github.com/tsi-coop/tsi-dpdp-cms/releases/tag/v0.5.3 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-108810 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/963801 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416587 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416587/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tsi-coop tsi-dpdp-cms | <= 0.5.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |