CVE-2026-116471 in Decoy
Summary
by MITRE • 10/26/2026
A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
A critical security vulnerability has been identified within BKWLD Decoy, specifically affecting versions up through 5.11.1. This flaw resides within the Authorization Policy component, manifesting as a defect in an unknown function located inside the Policy.php file. The core technical issue is classified as improper privilege management, where the application fails to correctly enforce access controls when processing the role argument passed by users or external systems. Because the vulnerability allows for remote exploitation, attackers can interact with the service over a network without requiring prior authentication or local system access, significantly lowering the barrier to entry for malicious actors seeking to compromise the integrity of the deployment.
The technical nature of this flaw aligns closely with CWE-269, which describes Improper Privilege Management, and potentially CWE-862, Missing Authorization Check. In a properly secured application, every request involving sensitive operations must be validated against the user's assigned roles and permissions before execution. However, in BKWLD Decoy versions up to 5.11.1, the validation logic within Policy.php appears to bypass or fail to correctly interpret the role parameter provided by the client. This oversight allows an attacker to manipulate this argument to escalate privileges beyond what is intended for their current session. By crafting specific HTTP requests that alter the role identifier in transit or during processing, a remote user can effectively impersonate higher-privileged accounts such as administrators or system operators.
The operational impact of this vulnerability is severe due to its remote exploitability and the availability of public proof-of-concept code. The fact that an exploit has been released into the wild means that automated scanning tools and opportunistic attackers are actively leveraging this weakness against vulnerable instances on the internet. Successful exploitation could lead to a complete compromise of the BKWLD Decoy environment, allowing unauthorized access to sensitive data, modification or deletion of critical configurations, and potentially using the compromised system as a pivot point for further attacks within the internal network. The lack of vendor response since early contact suggests that users are currently operating without official patches or guidance from the software provider, increasing reliance on community-driven mitigation strategies and manual code remediation efforts.
To mitigate this risk in the absence of an official patch, organizations should implement strict input validation at the application layer to ensure that role parameters match expected values before they reach the authorization logic. Network-level controls such as Web Application Firewalls can be configured to detect and block anomalous requests targeting the Policy.php endpoint with suspicious role arguments. Additionally, reviewing access logs for unusual privilege escalation patterns or unauthorized administrative actions is recommended. Until a verified patch is available from BKWLD, it is advisable to restrict public internet exposure of this component if possible, limiting access to trusted internal networks only, and ensuring that all other security controls are hardened to compensate for the missing authorization checks in the affected code path.