🟠 《高危安全漏洞：CVE-2026-65708》

CVSS 评分: 高危（8.6）　　状态: Received　　发布时间: 2026-07-24

漏洞描述

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions to enumerate and manipulate any attachment in the vault, bypassing account-level access controls entirely.

🔍 技术细节

字段 值
CVE ID CVE-2026-65708
CVSS 评分 8.6 🟠
严重程度 高危
CVSS 向量 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE 分类 CWE-639
发布时间 2026-07-24
最后更新 2026-07-24
状态 Received
数据来源 disclosure@vulncheck.com

🔗 参考链接