Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-113702 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The patch is identified as ac7427130865ce0ed80870813317c87ae3060fa4/7bf0b10199782e04aa579e9d516e473b164afd1c/db903abdcb3aba124cce670608ae6d7ba5f51a84/66f7417c5357b7575e39e8be390602156c1a1225. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CNA: [email protected]CVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/iomad/iomad/	[email protected]	Vendor
https://github.com/iomad/iomad/commit/66f7417c5357b7575e39e8be390602156c1a1225	[email protected]	Source CodeVendor
https://github.com/iomad/iomad/issues/2817	[email protected]	Issue TrackingTechnical DescriptionVendor
https://vuldb.com/cve/CVE-2026-113702	[email protected]	AdvisoryPermission Required
https://vuldb.com/vuln/433093	[email protected]	AdvisoryPermission Required
https://vuldb.com/vuln/433093/cti	[email protected]	AdvisoryPermission Required

see all 6 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-285	Improper Authorization	[email protected]
CWE-639	Authorization Bypass Through User-Controlled Key	[email protected]

Affected Products

Product	Versions
iomad	<= 4.5.15 (semver) <= 5.0.11 (semver) <= 5.1.8 (semver) <= 5.2.4 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Patch: ac7427130865ce0ed80870813317c87ae3060fa4moderate effort Patch: 7bf0b10199782e04aa579e9d516e473b164afd1cmoderate effort Patch: db903abdcb3aba124cce670608ae6d7ba5f51a84moderate effort Patch: 66f7417c5357b7575e39e8be390602156c1a1225moderate effort

Change History

1 change record found show changes