Common Weakness Enumeration
CWE-620
Weakness AllowedUnverified Password Change
Abstraction: Base · Status: Draft
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Architecture and Design
Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Content history
Submission: CWE Content Team
· MITRE
· 2007-05-07
· CWE Draft 6
Modification: Eric Dalci
· Cigital
· 2008-07-01
· CWE 1.0
updated Time_of_Introduction
Modification:
· Veracode
· 2008-08-15
· CWE 1.0
Suggested OWASP Top Ten 2004 mapping
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Description, Relationships, Observed_Example, Other_Notes, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2008-11-24
· CWE 1.1
updated Observed_Examples
Modification: CWE Content Team
· MITRE
· 2009-05-27
· CWE 1.4
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2009-12-28
· CWE 1.7
updated Other_Notes, Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Demonstrative_Examples, Observed_Examples, References, Relationships
Modification: CWE Content Team
· MITRE
· 2012-10-30
· CWE 2.3
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2014-06-23
· CWE 2.7
updated Relationships
Modification: CWE Content Team
· MITRE
· 2014-07-30
· CWE 2.8
updated Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Applicable_Platforms, Modes_of_Introduction, Relationships
Modification: CWE Content Team
· MITRE
· 2018-03-27
· CWE 3.1
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Relationships, Type
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2022-10-13
· CWE 4.9
updated Relationships
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Applicable_Platforms, Relationships
Modification: CWE Content Team
· MITRE
· 2026-04-30
· CWE 4.20
updated Observed_Examples
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Common_Consequences, Description
203 vulnerabilities reference this CWE, most recent first.
CVE-2026-128331 (GCVE-0-2026-128331)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:33 – Updated: 2026-11-13 16:02
VLAI
EPSS
VEX
Title
Miniflux before 2.3.5 Password Change Without Current Password via Settings Form
Summary
Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:29 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/miniflux/v2/security/advisorie… | vendor-advisory |
| https://github.com/miniflux/v2/commit/f654f7c7675… | patch |
| https://github.com/miniflux/v2/pull/4596 | issue-trackingpatch |
| https://github.com/miniflux/v2/releases/tag/v2.3.5 | release-notes |
| https://github.com/miniflux/v2/blob/v2.3.4/intern… | technical-description |
| https://github.com/miniflux/v2/blob/v2.3.4/intern… | technical-description |
| https://www.vulncheck.com/advisories/miniflux-bef… | third-party-advisory |
Impacted products
Date Public
2026-11-12 04:34
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-128331",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T15:29:12.069685Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T16:02:13.254Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/miniflux.app/v2",
"product": "miniflux",
"vendor": "miniflux",
"versions": [
{
"lessThan": "2.3.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:miniflux_project:miniflux:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sandipkumar sah"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Fr\u00e9d\u00e9ric Guillot"
}
],
"datePublic": "2026-11-12T04:34:34.000Z",
"descriptions": [
{
"lang": "en",
"value": "Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:33:42.840Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-ch38-3q93-fwg8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8"
},
{
"tags": [
"patch"
],
"url": "https://github.com/miniflux/v2/commit/f654f7c7675e5c4cbd6ef5bb5858aa8d9bdf2af1"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/miniflux/v2/pull/4596"
},
{
"name": "miniflux v2.3.5 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/miniflux/v2/releases/tag/v2.3.5"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/settings_update.go#L19-L98"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/form/settings.go#L126-L128"
},
{
"name": "VulnCheck Advisory: Miniflux before 2.3.5 Password Change Without Current Password via Settings Form",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/miniflux-before-2.3.5-password-change-without-current-password-via-settings-form"
}
],
"title": "Miniflux before 2.3.5 Password Change Without Current Password via Settings Form",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-128331",
"datePublished": "2026-11-13T09:33:42.840Z",
"dateReserved": "2026-11-13T01:20:36.753Z",
"dateUpdated": "2026-11-13T16:02:13.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-127058 (GCVE-0-2026-127058)
Vulnerability from cvelistv5 – Published: 2026-11-12 13:09 – Updated: 2026-11-13 18:49 X_Open Source
VLAI
EPSS
VEX
Title
WonderCMS before 3.7.0 Unverified Password Change via saveAction
Summary
WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 18:48 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/WonderCMS/wondercms/security/a… | vendor-advisory |
| https://github.com/WonderCMS/wondercms/releases#r… | release-notespatch |
| https://www.vulncheck.com/advisories/wondercms-be… | third-party-advisory |
Impacted products
Date Public
2026-11-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-127058",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T18:48:27.365350Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T18:49:23.525Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/WonderCMS/wondercms",
"product": "wondercms",
"repo": "https://github.com/WonderCMS/wondercms",
"vendor": "WonderCMS",
"versions": [
{
"lessThan": "3.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
},
{
"lang": "en",
"type": "finder",
"value": "manop55555"
}
],
"datePublic": "2026-11-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T13:09:59.086Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Vendor Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/WonderCMS/wondercms/security/advisories/GHSA-qc3r-v7fc-24xc"
},
{
"name": "Vendor Patch",
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/WonderCMS/wondercms/releases#release-3.7.0"
},
{
"name": "VulnCheck Advisory: WonderCMS before 3.7.0 Unverified Password Change via saveAction",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wondercms-before-unverified-password-change-via-saveaction"
}
],
"tags": [
"x_open-source"
],
"title": "WonderCMS before 3.7.0 Unverified Password Change via saveAction",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-127058",
"datePublished": "2026-11-12T13:09:59.086Z",
"dateReserved": "2026-11-12T13:05:14.832Z",
"dateUpdated": "2026-11-13T18:49:23.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119429 (GCVE-0-2026-119429)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:54
VLAI
EPSS
VEX
Title
phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
Summary
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/b… | patch |
| https://github.com/phpmyadmin/phpmyadmin/commit/6… | patch |
| https://github.com/phpmyadmin/phpmyadmin/pull/19087 | patchissue-tracking |
| https://github.com/phpmyadmin/phpmyadmin/blob/REL… | technical-description |
| https://abraxaslabs.tech/research/phpmyadmin-conf… | third-party-advisory |
| https://github.com/phpmyadmin/phpmyadmin | product |
| https://www.vulncheck.com/advisories/phpmyadmin-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| phpMyAdmin | phpMyAdmin |
Affected:
0 , ≤ 5.2.3
(semver)
cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:* |
Date Public
2026-10-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119429",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:00.472324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:54:53.572Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/phpmyadmin/phpmyadmin",
"product": "phpMyAdmin",
"repo": "https://github.com/phpmyadmin/phpmyadmin",
"vendor": "phpMyAdmin",
"versions": [
{
"lessThanOrEqual": "5.2.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.2.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Maur\u00edcio Meneghini Fauth"
}
],
"datePublic": "2026-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:57.953Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b2a3e41f1e9ce42d1ee3f07a91f476029987799f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/6482dfa28bd56d515f482b008b194a516646fe1b"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/pull/19087"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Controllers/Config/SetConfigController.php#L29-L41"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/phpmyadmin-config-set-2fa"
},
{
"tags": [
"product"
],
"url": "https://github.com/phpmyadmin/phpmyadmin"
},
{
"name": "VulnCheck Advisory: phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-two-factor-authentication-removal-via-config-set"
}
],
"title": "phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119429",
"datePublished": "2026-10-30T11:30:57.953Z",
"dateReserved": "2026-10-30T02:41:15.377Z",
"dateUpdated": "2026-10-30T15:54:53.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118984 (GCVE-0-2026-118984)
Vulnerability from cvelistv5 – Published: 2026-10-29 10:44 – Updated: 2026-10-29 12:36
VLAI
EPSS
VEX
Title
OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login
Summary
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 12:20 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/cheaper-inference/OmniRoute/pu… | patchissue-tracking |
| https://github.com/cheaper-inference/OmniRoute/co… | patch |
| https://github.com/cheaper-inference/OmniRoute/bl… | technical-description |
| https://github.com/cheaper-inference/OmniRoute/bl… | technical-description |
| https://github.com/cheaper-inference/OmniRoute/re… | release-notes |
| https://github.com/cheaper-inference/OmniRoute | product |
| https://www.vulncheck.com/advisories/omniroute-3.… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cheaper-inference | OmniRoute |
Affected:
3.8.0 , < 3.8.52
(semver)
|
Date Public
2026-10-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118984",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T12:20:39.806428Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T12:36:53.458Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/omniroute",
"product": "OmniRoute",
"vendor": "cheaper-inference",
"versions": [
{
"lessThan": "3.8.52",
"status": "affected",
"version": "3.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rachid Marcil (gsmarcil)"
}
],
"datePublic": "2026-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:44:39.676Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #16897",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/cheaper-inference/OmniRoute/pull/16897"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/cheaper-inference/OmniRoute/commit/dde27f4964872c9b43cfd5b8f532693f6c018af6"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/require-login/route.ts#L90-L130"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/route.ts#L374-L422"
},
{
"name": "OmniRoute v3.8.52 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52"
},
{
"tags": [
"product"
],
"url": "https://github.com/cheaper-inference/OmniRoute"
},
{
"name": "VulnCheck Advisory: OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/omniroute-3.8.0-before-3.8.52-unverified-password-change-via-api-settings-require-login"
}
],
"title": "OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118984",
"datePublished": "2026-10-29T10:44:39.676Z",
"dateReserved": "2026-10-29T10:39:33.380Z",
"dateUpdated": "2026-10-29T12:36:53.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112002 (GCVE-0-2026-112002)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:38 – Updated: 2026-10-19 16:38
VLAI
EPSS
VEX
Title
ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
Summary
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:41 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/projectsend/projectsend/securi… | vendor-advisory |
| https://github.com/projectsend/projectsend/commit… | patch |
| https://github.com/projectsend/projectsend/releas… | release-notes |
| https://github.com/projectsend/projectsend/blob/v… | technical-description |
| https://www.vulncheck.com/advisories/projectsend-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProjectSend | ProjectSend |
Affected:
2.5.0 , < 2.7.0
(semver)
cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:* |
Date Public
2026-10-07 02:39
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:41:31.963964Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:38:48.998Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/projectsend/projectsend",
"product": "ProjectSend",
"repo": "https://github.com/projectsend/projectsend",
"vendor": "ProjectSend",
"versions": [
{
"lessThan": "2.7.0",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.0",
"versionStartIncluding": "2.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "WHS4th Team TokenManiZo"
}
],
"datePublic": "2026-10-07T02:39:59.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:38:27.111Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4r8h-mwfm-f5f4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/projectsend/projectsend/security/advisories/GHSA-4r8h-mwfm-f5f4"
},
{
"tags": [
"patch"
],
"url": "https://github.com/projectsend/projectsend/commit/717852ff6a99391dbd816a2bb0bb3f40cad70f72"
},
{
"name": "ProjectSend v2.7.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/projectsend/projectsend/releases/tag/v2.7.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/projectsend/projectsend/blob/v2.6.0/app/Http/Controllers/Settings/PasswordController.php#L54-L90"
},
{
"name": "VulnCheck Advisory: ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/projectsend-2.5.0-before-2.7.0-unverified-password-change-via-settings-password"
}
],
"title": "ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112002",
"datePublished": "2026-10-18T11:38:27.111Z",
"dateReserved": "2026-10-18T01:23:19.660Z",
"dateUpdated": "2026-10-19T16:38:48.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105785 (GCVE-0-2026-105785)
Vulnerability from cvelistv5 – Published: 2026-10-05 23:12 – Updated: 2026-10-08 02:35
VLAI
EPSS
VEX
Title
Joplin Server password reset accepts tokens issued for unrelated purposes
Summary
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2.
Severity
4.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 02:35 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/laurent22/joplin/security/advi… | x_refsource_CONFIRM |
| https://github.com/laurent22/joplin/pull/16274 | x_refsource_MISC |
| https://github.com/laurent22/joplin/commit/7766ee… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105785",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T02:35:04.011804Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T02:35:28.061Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-8qm8-mp6h-qf35"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joplin",
"vendor": "laurent22",
"versions": [
{
"status": "affected",
"version": "\u003c 3.7.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim\u0027s CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim\u0027s password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T23:12:45.286Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/laurent22/joplin/security/advisories/GHSA-8qm8-mp6h-qf35",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/laurent22/joplin/security/advisories/GHSA-8qm8-mp6h-qf35"
},
{
"name": "https://github.com/laurent22/joplin/pull/16274",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/laurent22/joplin/pull/16274"
},
{
"name": "https://github.com/laurent22/joplin/commit/7766eefa11fa006b6a1971da24e0c820cf1d2118",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/laurent22/joplin/commit/7766eefa11fa006b6a1971da24e0c820cf1d2118"
}
],
"source": {
"advisory": "GHSA-8qm8-mp6h-qf35",
"discovery": "UNKNOWN"
},
"title": "Joplin Server password reset accepts tokens issued for unrelated purposes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105785",
"datePublished": "2026-10-05T23:12:45.286Z",
"dateReserved": "2026-10-05T20:37:19.363Z",
"dateUpdated": "2026-10-08T02:35:28.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104106 (GCVE-0-2026-104106)
Vulnerability from cvelistv5 – Published: 2026-10-14 20:36 – Updated: 2026-10-15 15:04
VLAI
EPSS
VEX
Title
FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification
Summary
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no TOTP secret. The enrollment endpoint returns 409 rather than directly overwriting an already configured secret, but it persists and activates a newly generated secret before a TOTP code verifies possession. An attacker controlling an existing authenticated session can therefore disable an existing second factor or enroll one after the account has no configured secret; this is not a direct overwrite of an active authenticator. This issue is fixed in version 3.23.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:52 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/error311/FileRise/security/adv… | x_refsource_CONFIRM |
| https://github.com/error311/FileRise/commit/cc111… | x_refsource_MISC |
| https://github.com/error311/FileRise/releases/tag… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:52:03.051138Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:04:46.143Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "FileRise",
"vendor": "error311",
"versions": [
{
"status": "affected",
"version": "\u003c 3.23.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no TOTP secret. The enrollment endpoint returns 409 rather than directly overwriting an already configured secret, but it persists and activates a newly generated secret before a TOTP code verifies possession. An attacker controlling an existing authenticated session can therefore disable an existing second factor or enroll one after the account has no configured secret; this is not a direct overwrite of an active authenticator. This issue is fixed in version 3.23.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T20:36:27.436Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/error311/FileRise/security/advisories/GHSA-77m8-hm3q-mrr5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/error311/FileRise/security/advisories/GHSA-77m8-hm3q-mrr5"
},
{
"name": "https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a"
},
{
"name": "https://github.com/error311/FileRise/releases/tag/v3.23.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/error311/FileRise/releases/tag/v3.23.0"
}
],
"source": {
"advisory": "GHSA-77m8-hm3q-mrr5",
"discovery": "UNKNOWN"
},
"title": "FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-104106",
"datePublished": "2026-10-14T20:36:27.436Z",
"dateReserved": "2026-10-01T18:05:14.173Z",
"dateUpdated": "2026-10-15T15:04:46.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102603 (GCVE-0-2026-102603)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:21 – Updated: 2026-10-14 14:45
VLAI
EPSS
VEX
Title
Gotify: Insufficiently Protected Password Change endpoint
Summary
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:43 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/gotify/server/security/advisor… | x_refsource_CONFIRM |
| https://github.com/gotify/server/pull/952 | x_refsource_MISC |
| https://github.com/gotify/server/commit/a8744482c… | x_refsource_MISC |
| https://github.com/gotify/server/releases/tag/v3.0.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:43:27.030912Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:45:36.133Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "gotify",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account\u0027s current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:21:20.867Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9"
},
{
"name": "https://github.com/gotify/server/pull/952",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/pull/952"
},
{
"name": "https://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9"
},
{
"name": "https://github.com/gotify/server/releases/tag/v3.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/releases/tag/v3.0.0"
}
],
"source": {
"advisory": "GHSA-3hcj-9m7p-wwm9",
"discovery": "UNKNOWN"
},
"title": "Gotify: Insufficiently Protected Password Change endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102603",
"datePublished": "2026-10-13T14:21:20.867Z",
"dateReserved": "2026-09-29T14:18:02.920Z",
"dateUpdated": "2026-10-14T14:45:36.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97380 (GCVE-0-2026-97380)
Vulnerability from cvelistv5 – Published: 2026-10-16 16:23 – Updated: 2026-10-28 18:07
VLAI
EPSS
VEX
Title
MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 18:06 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/dbd60d0a… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40470 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T18:06:48.259649Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T18:07:06.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account\u0027s password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:23:07.975Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr"
},
{
"name": "https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40470",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40470"
}
],
"source": {
"advisory": "GHSA-625w-4hgq-qwmr",
"discovery": "UNKNOWN"
},
"title": "MariaDB: GRANT PROXY with empty password incorrectly checks grantor\u0027s privileges"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-97380",
"datePublished": "2026-10-16T16:23:07.975Z",
"dateReserved": "2026-09-24T14:16:20.201Z",
"dateUpdated": "2026-10-28T18:07:06.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92467 (GCVE-0-2026-92467)
Vulnerability from cvelistv5 – Published: 2026-09-16 13:16 – Updated: 2026-09-21 17:47
VLAI
EPSS
VEX
Title
microservices-platform through 6.0.0 Unverified Password Change via /users/password
Summary
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 17:47 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/zlt2000/microservices-platform… | technical-description |
| https://github.com/zlt2000/microservices-platform… | technical-description |
| https://github.com/LinYuanyi1/cve-request-poc/blo… | exploit |
| https://github.com/zlt2000/microservices-platform | product |
| https://www.vulncheck.com/advisories/microservice… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zlt2000 | microservices-platform |
Affected:
0 , ≤ 6.0.0
(semver)
cpe:2.3:a:zlt2000:microservices-platform:*:*:*:*:*:*:*:* |
Date Public
2026-09-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92467",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T17:47:06.890538Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T17:47:20.360Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/zlt2000/microservices-platform",
"product": "microservices-platform",
"repo": "https://github.com/zlt2000/microservices-platform",
"vendor": "zlt2000",
"versions": [
{
"lessThanOrEqual": "6.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zlt2000:microservices-platform:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mingsheng Lin"
}
],
"datePublic": "2026-09-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:16:43.820Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Password change endpoint takes the target account id from the request body, at v6.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-business/user-center/src/main/java/com/central/user/controller/SysUserController.java#L206"
},
{
"name": "Current-password check is skipped when oldPassword is blank, at v6.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-business/user-center/src/main/java/com/central/user/service/impl/SysUserServiceImpl.java#L165"
},
{
"name": "Reporter proof of concept: set another account\u0027s password without the current one",
"tags": [
"exploit"
],
"url": "https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C09_reset_any_user_password.py"
},
{
"name": "zlt2000/microservices-platform",
"tags": [
"product"
],
"url": "https://github.com/zlt2000/microservices-platform"
},
{
"name": "VulnCheck Advisory: microservices-platform through 6.0.0 Unverified Password Change via /users/password",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-unverified-password-change-via-users-password"
}
],
"title": "microservices-platform through 6.0.0 Unverified Password Change via /users/password",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92467",
"datePublished": "2026-09-16T13:16:43.820Z",
"dateReserved": "2026-09-16T11:29:56.293Z",
"dateUpdated": "2026-09-21T17:47:20.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
When prompting for a password change, force the user to provide the original password in addition to the new password.
Mitigation
Architecture and Design
Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.
No CAPEC attack patterns related to this CWE.