CVE-2026-84839 in tsi-dpdp-cms
Summary
by MITRE • 09/02/2026
A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.1 can resolve this issue. It is suggested to upgrade the affected component.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The tsi-coop tsi-dpdp-cms software, specifically versions up through 0.5.0, contains a critical security flaw within its administrative and Data Protection Officer compliance console components. This vulnerability centers on the improper configuration or handling of the web.xml deployment descriptor file, which serves as a central configuration resource for Java-based web applications. The web.xml file typically defines servlet mappings, filter chains, context parameters, and crucially, security constraints that dictate access control policies for various application endpoints. In this instance, the flaw results in missing authentication mechanisms being enforced on specific administrative functionalities exposed through the console interface. This misconfiguration effectively bypasses intended security controls, allowing unauthenticated users to interact with sensitive management features that should require valid credentials.
From a technical perspective, the root cause lies in how the application server interprets or applies the security constraints defined within the web.xml file for the Admin Console and DPO Compliance Console endpoints. When these constraints are either omitted, incorrectly scoped, or overridden by default settings due to configuration errors, the resulting state permits direct access without prior authentication checks. This aligns with CWE-287, which describes Improper Authentication, as well as CWE-16, known as Configuration Errors. The absence of mandatory authentication for administrative functions represents a severe deviation from secure coding practices and standard web application security frameworks such as OWASP Top 10, specifically relating to Broken Access Control and Identification and Authentication Failures.
The operational impact of this vulnerability is significant due to its remote exploitable nature. Attackers located on the network or internet can exploit this flaw without any prior interaction with a legitimate user. By directly accessing the administrative URLs associated with the console components, an attacker can bypass login screens entirely. This lack of authentication control enables unauthorized individuals to perform sensitive operations within the system. Depending on the specific functionalities exposed through these unauthenticated endpoints, potential consequences include full compromise of the application's integrity, exposure of confidential data managed by the DPO compliance module, modification or deletion of critical configuration settings, and potentially further lateral movement into internal networks if administrative privileges allow for deeper system interactions.
The risk is exacerbated by the fact that this exploit has been publicly disclosed and proof-of-concept code may be available to threat actors. Public disclosure significantly lowers the barrier to entry for attackers who might not possess advanced exploitation skills but can leverage existing tools or scripts to target vulnerable instances. Organizations running affected versions are therefore at immediate risk of automated scanning attacks where malicious bots actively probe for known misconfigurations in web.xml files across various internet-facing services. The visibility of this vulnerability means that defensive measures must be implemented promptly rather than waiting for a scheduled maintenance window, as the likelihood of opportunistic exploitation is high.
To mitigate this vulnerability and restore secure access controls, it is strongly recommended to upgrade tsi-coop tsi-dpdp-cms to version 0.5.1 or later immediately upon availability. This updated release addresses the underlying configuration issues within the web.xml file for the affected components, ensuring that proper authentication checks are enforced before any administrative actions can be executed. In addition to upgrading, organizations should verify their deployment configurations to ensure no other endpoints have been inadvertently exposed without adequate security constraints. Implementing network-level access controls such as firewalls or reverse proxies that restrict direct internet access to administrative interfaces until the upgrade is complete can provide an additional layer of defense against exploitation attempts during the transition period.