CVE-2026-65709 Details
Description
sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions.
A missing object-level authorization vulnerability has been identified in the sysPass PHP password manager, specifically in version 3.2.11. This vulnerability resides within the JSON-RPC API, where API token holders can bypass per-account access controls. The flaw allows for unauthorized enumeration of account metadata, overwriting of passwords, and deletion of accounts across the entire vault. The issue arises because several account-related methods in the AccountController do not properly verify if the token owner is authorized to access the requested account, enabling low-privileged users to manipulate accounts beyond their assigned permissions.
To address this vulnerability, the same user-scoped object authorization should be applied to all id-based account API methods. This can be achieved by requiring an account filter or ACL check before executing the view, edit, delete, and editPass actions, similar to the existing behavior of the viewPass and search methods.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 24, 2026CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sysPass | <= 3.2.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | New CVE Received | [email protected] |