CVE-2026-65472 in Kit Plugin
Summary
by MITRE • 07/23/2026
Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability represents a critical breakdown in access control mechanisms within the Kit platform, formerly known as ConvertKit, affecting versions prior to 3.3.5. The flaw allows unauthenticated attackers to bypass legitimate authentication processes and gain unauthorized access to protected resources and functionalities. The vulnerability stems from insufficient validation of user credentials and session management, enabling malicious actors to exploit weak authorization checks that should have prevented unauthorized access to administrative functions, user data, and system configurations.
The technical implementation of this broken access control issue manifests through improper input validation and inadequate privilege verification mechanisms within the application's authentication flow. Attackers can manipulate API endpoints or web interfaces to access restricted areas without providing valid credentials, effectively circumventing the intended security boundaries that separate authenticated users from administrative privileges. This type of vulnerability directly maps to CWE-285, which addresses improper authorization in software systems, and aligns with ATT&CK technique T1078 for valid accounts and T1566 for credential harvesting through application vulnerabilities.
The operational impact of this vulnerability extends beyond simple unauthorized data access, potentially enabling attackers to modify user accounts, manipulate campaign data, access sensitive customer information, and perform administrative actions within the platform. Given that Kit serves marketing automation and email service functionalities, compromised systems could lead to widespread data exposure, including subscriber lists, campaign analytics, and personal information of thousands of users. The vulnerability's unauthenticated nature means that attackers can exploit it without requiring any prior credentials or account access.
Mitigation strategies should include immediate upgrading to version 3.3.5 or later, which contains the necessary patches addressing the broken access control implementation. Organizations should also implement comprehensive network monitoring to detect unusual access patterns and unauthorized API calls, while conducting thorough security assessments of all application endpoints to identify similar authorization flaws. Additional defensive measures include implementing proper rate limiting on authentication endpoints, enforcing multi-factor authentication for administrative accounts, and establishing robust logging mechanisms to track access attempts and potential exploitation activities. Security teams should also review and strengthen their input validation processes and privilege escalation controls to prevent similar vulnerabilities from emerging in other components of the platform architecture.