CVE-2026-65709 in sysPass
Summary
by MITRE • 07/24/2026
sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The sysPass vulnerability in version 3.2.11 represents a critical authorization flaw that fundamentally undermines the security model of the application's JSON-RPC API implementation. This missing object-level authorization control creates a scenario where legitimate API token holders can bypass normal access restrictions and perform unauthorized operations across all accounts within the vault. The vulnerability stems from insufficient validation mechanisms within the AccountController methods, specifically failing to enforce proper user context checks before executing sensitive operations.
The technical exploitation of this vulnerability occurs through direct invocation of AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without proper AccountFilterUser validation. This architectural weakness allows attackers with valid API tokens to enumerate account metadata and access information that should be restricted to authorized users only. The absence of per-account access control checks means that any authenticated API token holder can manipulate accounts beyond their intended scope, effectively granting them administrative privileges across the entire vault system.
The operational impact of this vulnerability extends far beyond simple data enumeration, as it enables complete account compromise through password overwrites and account deletion operations. Attackers can systematically destroy or modify account information without detection, potentially causing significant data loss and service disruption. The vulnerability affects all accounts within the vault regardless of individual user permissions, creating a scenario where a single compromised API token can result in widespread damage to the organization's credential management infrastructure.
This vulnerability aligns with CWE-639 Access Control Bypass and represents a classic example of insufficient authorization checks at the application level. From an ATT&CK perspective, this flaw maps to privilege escalation techniques and credential access phases, as it allows attackers to bypass normal user boundaries and gain unauthorized access to sensitive information. The risk is compounded by the fact that API tokens are often long-lived credentials that may not be regularly rotated or monitored for unusual activity patterns.
Organizations should implement immediate mitigations including enforcing strict object-level authorization checks in all JSON-RPC API endpoints, implementing proper AccountFilterUser validation mechanisms, and establishing token scope limitations to restrict operations to specific account ranges. Additionally, regular API token rotation policies and monitoring for anomalous access patterns should be implemented to detect potential exploitation attempts. The vulnerability highlights the critical importance of defense-in-depth security measures and proper access control implementation in modern web applications.