CVE-2026-86055 Details

A vulnerability in Part-DB, an open-source inventory management system for electronic components, allows for pre-authentication administrative account takeover. This issue exists in versions through 2.13.2. The vulnerability arises because Part-DB generates the absolute URL for password reset links based on the client-supplied HTTP Host header, without validating it against a trusted host list. An unauthenticated attacker can exploit this by sending a spoofed Host header with a forgot-password request for a known account. The system then emails a reset link to the victim with an attacker-controlled hostname, but still includes the genuine reset token. When the victim clicks the link, or if an automated email scanner does so, the token is revealed to the attacker. They can then use this token to reset the password and take over the account. Since the admin account can be targeted, this exploitation allows full access to the administrative functions of the application.

Users are advised to update to Part-DB version 2.13.3 or later, where this vulnerability has been patched.