CVE-2026-65708 Details

A vulnerability allowing insecure direct object reference has been identified in sysPass version 3.2.11. This vulnerability allows authenticated attackers to access file attachments from accounts outside their ACL permissions. The issue arises from missing authorization checks in the AccountFileController, which handles file operations using user-supplied numeric IDs. As a result, attackers can enumerate and manipulate attachments, bypassing account-level access controls entirely.

To address this vulnerability, it is recommended to implement authorization checks that verify a user's access to the parent account before allowing any file operations. This should include validating account-level ACL permissions and enforcing profile-level file permissions for upload and delete actions.