CVE-2026-5779
IDOR in MphRx Minerva V3.6.0 Enables Account Takeover
Publication date: 2026-04-28
Last updated on: 2026-05-05
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| agilonhealth | minerva | 3.6.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an insecure direct object reference (IDOR) in MphRx's Minerva version 3.6.0, specifically in the '/minerva/user/updateUserProfile' endpoint.
It allows an authenticated user to modify the information of other registered users.
For example, an attacker can change another user's email address and then request a new password for that user via the '/webconnect/#/forgotPassword' endpoint.
This can lead to a complete takeover of other users' accounts.
How can this vulnerability impact me? :
The vulnerability can have severe impacts including unauthorized modification of user information.
An attacker who exploits this flaw can take over other users' accounts by changing their email addresses and resetting their passwords.
This compromises user privacy and security, potentially leading to data breaches, loss of trust, and unauthorized access to sensitive information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an authenticated user to modify other users' information, including email addresses, and potentially take over accounts. This unauthorized access and modification of personal data could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls over access to personal and sensitive information.
Specifically, the ability to alter user profiles and request password resets without proper authorization undermines data integrity and confidentiality, key principles in these regulations.