CVE-2026-76876 in Craftplan
Summary
by MITRE • 08/21/2026
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/21/2026
Craftplan versions prior to 0.5.1 suffer from a critical broken access control vulnerability within its Settings resource management functionality. This flaw stems from an unconditional authorization policy applied to sensitive configuration endpoints, specifically allowing unauthenticated actors to retrieve highly privileged data without any form of identity verification or session validation. The core technical deficiency lies in the application's authentication middleware and role-based access control implementation, which fails to enforce proper checks before processing requests directed at the settings API endpoint. Consequently, any user possessing a valid record ID for a specific configuration entry can bypass security controls entirely by issuing standard HTTP GET requests to these protected routes. This represents a fundamental failure in implementing secure defaults and principle of least privilege, as the system assumes trust where none should be granted based on network position or request origin alone.
The operational impact of this vulnerability is severe due to the nature of the data exposed. Attackers can extract decrypted SMTP passwords, email API keys, and associated secrets directly from the database through these unauthorized requests. The exposure of plaintext credentials allows malicious actors to impersonate legitimate services for sending emails, potentially facilitating phishing campaigns, spam distribution, or further social engineering attacks against users of the Craftplan platform. Furthermore, access to email API keys may enable attackers to manipulate communication channels linked to user accounts, leading to data leakage or account takeover scenarios if those integrations are tied to broader authentication workflows. The ability to read these secrets without restriction means that once an attacker identifies a valid record ID, they can systematically harvest credentials across multiple tenants or instances depending on the deployment architecture and whether IDs follow predictable patterns.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting scenarios where authorization checks are omitted for sensitive resources. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as attackers leverage valid identifiers to access restricted information despite lacking proper authentication credentials. The exploitation path involves simple HTTP request manipulation rather than complex buffer overflows or injection attacks, highlighting how misconfigured security policies can be more dangerous than code-level bugs in modern web applications. Organizations running affected versions must treat this issue with high priority due to the direct exposure of long-lived secrets that could compromise downstream systems and user privacy indefinitely if not rotated promptly after remediation.
Mitigation strategies require immediate patching to version 0.5.1 or later, where the authorization logic has been corrected to enforce strict identity verification before granting access to settings data. In addition to upgrading, administrators should audit existing logs for signs of exploitation by monitoring for unusual GET requests targeting the settings endpoint from unknown IP addresses. It is crucial to rotate all exposed credentials immediately upon discovery, including SMTP passwords and API keys, since their compromise may have already occurred during the window of vulnerability exposure. Implementing robust input validation alongside comprehensive authorization checks will prevent similar issues in future updates, ensuring that only authenticated users with appropriate roles can modify or view sensitive configuration parameters. Regular security assessments focusing on access control mechanisms should be integrated into development lifecycles to detect such misconfigurations early before they reach production environments.