CVE-2026-80254 in ShizenBox2
Summary
by MITRE • 09/03/2026
Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log in to the product may change the other user's password.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified as a critical authorization bypass within the ShizenBox2 edge application represents a fundamental failure in access control mechanisms. This flaw allows authenticated users to manipulate security settings belonging to other accounts, specifically by altering their passwords. In modern software architecture, particularly for IoT or edge computing devices like ShizenBox2, robust separation of user contexts is paramount. The existence of this vulnerability indicates that the application fails to properly validate whether the requesting user has administrative privileges over the target account resource before processing sensitive state changes. This type of flaw typically stems from a lack of server-side enforcement of object-level permissions or reliance on client-supplied identifiers without adequate verification against backend authorization policies.
From a technical perspective, this issue aligns with CWE-284 Improper Access Control and specifically CWE-639 Authorization Bypass Through User-Controlled Key. The core mechanism involves the application accepting an identifier for another user's account as input during a password reset or change operation without verifying that the current session holder is authorized to perform such actions on behalf of that specific entity. By exploiting this logic error, an attacker can leverage their own valid authentication token to issue requests targeting arbitrary user IDs. The system processes these requests because it trusts the provided key rather than checking the relationship between the authenticated principal and the target resource. This bypasses standard role-based or attribute-based access controls designed to isolate user data and operations.
The operational impact of this vulnerability is severe, as it effectively grants an attacker full control over any other account on the system once they have obtained valid credentials for at least one low-privilege account. By changing another user's password, the attacker can lock out legitimate users or assume their identity entirely. This leads to a complete compromise of confidentiality and integrity for those accounts. In the context of an edge device managing network infrastructure or industrial processes, such unauthorized access could lead to further lateral movement within the internal network, exfiltration of sensitive data stored on the device, or disruption of critical services managed by compromised administrative accounts. The ability to escalate privileges through account takeover is a significant threat vector that undermines the trust model of the entire application ecosystem.
This vulnerability maps directly to several techniques in the MITRE ATT&CK framework, most notably T1078 Valid Accounts and T1536 Prepare for Hijack. An attacker would first need to obtain valid credentials through phishing or credential stuffing (T1078) before exploiting this authorization bypass to hijack higher-privileged accounts (T1536). The subsequent actions could include data exfiltration, persistence establishment, or privilege escalation depending on the roles associated with the targeted accounts. Understanding these mappings is crucial for defenders who need to detect such behavior through monitoring of authentication logs and unusual account modification events.
Mitigation strategies must focus on implementing strict server-side authorization checks at every point where user-specific resources are accessed or modified. Developers should ensure that all operations involving user data verify that the authenticated session owner matches the resource owner, unless explicit administrative privileges are confirmed via a separate permission check mechanism such as RBAC (Role-Based Access Control) or ABAC (Attribute-Based Access Control). Input validation alone is insufficient; the application logic must explicitly enforce ownership boundaries. Additionally, implementing multi-factor authentication for sensitive operations like password changes can provide an additional layer of defense against account takeover attempts. Regular security code reviews and automated static analysis tools configured to detect improper access control patterns are essential preventive measures. For existing deployments, applying vendor-provided patches that address this specific logic flaw is the immediate priority to restore secure operational integrity.