CVE-2026-117472 Details
Description
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.
A vulnerability exists in Psono Server Community and Enterprise Editions, versions 4.0.33 through 7.2.3, where the bulk-secret-read endpoint improperly validates request paths. In deployments with a URL_PREFIX, this misalignment allowed an authenticated remote attacker with a write-enabled, read-disabled API key to access encrypted secret data and nonces, bypassing read permissions. The issue did not affect the default configuration without a URL_PREFIX.
Users can upgrade to Psono Server version 7.2.4 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, the URL_PREFIX configuration can be removed, or read-disabled, write-enabled API keys can be avoided until the upgrade is applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117472.md | fdf66990-8419-4c8c-8848-ec15d75773b4 | AdvisoryRemedyVendor |
| https://gitlab.com/esaqa/psono/psono-server | fdf66990-8419-4c8c-8848-ec15d75773b4 | ProductSource CodeVendor |
| https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/permissions.py | fdf66990-8419-4c8c-8848-ec15d75773b4 | Source CodeVendor |
| https://gitlab.com/esaqa/psono/psono-server/-/commit/5638d4be806af7d1dea03f7cad3927aa2bd19cf4 | fdf66990-8419-4c8c-8848-ec15d75773b4 | Source CodeVendor |
| https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4 | fdf66990-8419-4c8c-8848-ec15d75773b4 | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | fdf66990-8419-4c8c-8848-ec15d75773b4 |
Affected Products
| Product | Versions |
|---|---|
| Psono Server Community Edition | >= 4.0.33, <= 7.2.3 (semver) |
CPE
Remediation
| |
| Psono Server Enterprise Edition | >= 4.0.33, <= 7.2.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | fdf66990-8419-4c8c-8848-ec15d75773b4 |