CVE-2026-116471
Received Received - Intake

Improper Privilege Management in BKWLD Decoy Authorization Policy

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116471
EUVD
EUVD-2026-110066

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
BKWLD Decoy 5.11.0
BKWLD Decoy 5.11.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116471 is a security flaw in BKWLD Decoy software versions up to 5.11.1. It involves improper privilege management due to manipulation of the 'role' argument in the Policy.php file's authorization policy component. This allows remote attackers to escalate privileges without authentication.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive functions or data by manipulating user roles. Since the exploit is public, active attacks may occur. The low CVSS scores suggest limited impact but privilege escalation could still enable data breaches or system misuse.

Mitigation Strategies

Immediately update BKWLD Decoy to the latest version beyond 5.11.1 to address the improper privilege management in Policy.php. If no update is available, restrict remote access to the Authorization Policy component and monitor for unusual privilege escalation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116471. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart