CVE-2026-65708 in sysPass
Summary
by MITRE • 07/24/2026
sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions to enumerate and manipulate any attachment in the vault, bypassing account-level access controls entirely.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The sysPass vulnerability identified in version 3.2.11 represents a critical insecure direct object reference flaw that fundamentally undermines the application's access control mechanisms. This weakness exists within the AccountFileController component where the system fails to validate whether authenticated users possess proper authorization rights before permitting operations on file attachments. The vulnerability stems from the absence of mandatory permission checks when processing requests for account file operations, creating a pathway for malicious actors to bypass established security boundaries.
The technical implementation of this flaw allows attackers to exploit missing authorization validation by manipulating numeric file identifiers passed through various API endpoints including download, view, delete, upload, and list actions. When an authenticated user submits requests with arbitrary file ID parameters, the system processes these requests without verifying whether the user has legitimate access rights to the targeted attachments. This creates a scenario where any authenticated attacker can enumerate and manipulate file attachments belonging to accounts they should not be able to access based on their assigned access control lists.
The operational impact of this vulnerability extends beyond simple data exposure as it enables comprehensive manipulation of file attachments within the system. Attackers can not only view sensitive documents but also delete, modify, or upload new files to any account in the vault, effectively rendering the access control list mechanism ineffective. This represents a complete bypass of the application's security model and allows for potential data exfiltration, corruption, or malicious file injection attacks that could compromise the integrity of the entire system.
This vulnerability aligns with CWE-639 which specifically addresses insecure direct object reference flaws that occur when applications fail to verify authorization before processing user-supplied object identifiers. The flaw also corresponds to ATT&CK technique T1078 which covers valid accounts and credential access, as attackers can leverage authenticated sessions to perform unauthorized operations. Organizations implementing sysPass must recognize this as a critical security gap that requires immediate remediation through proper input validation, mandatory authorization checks, and robust access control enforcement mechanisms.
Mitigation strategies should focus on implementing comprehensive authorization validation at every point where file operations occur within the AccountFileController. The system must verify user permissions against each requested file identifier before executing any operations, ensuring that access controls are enforced regardless of authentication status. Additionally, proper logging and monitoring of file access patterns can help detect anomalous behavior indicative of exploitation attempts. Regular security assessments should include testing for similar authorization bypass vulnerabilities in other components of the application to prevent similar issues from persisting across the system architecture.