CVE-2026-0873
Unknown
Unknown - Not Provided
Privilege Escalation in Ercom Cryptobox Admin Console
Vulnerability report for CVE-2026-0873, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-02-04
Last updated on: 2026-02-04
Assigner: Thales Group
Description
Description
On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an authenticated entity administrator with knowledge to elevate his account to global administrator.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ercom | cryptobox | 4.40 |
| ercom | cryptobox-cfsb | 4.38.295 |
| ercom | helm_chart | 4.40.166 |
| ercom | mobile_apps_for_android | 4.40.153 |
| ercom | mobile_apps_for_ios | 4.40.152 |
| ercom | desktop_sync_clients | 4.40.152 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-1220 | The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
