Subscriber Authentication Bypass in FunnelKit Automations

Publication date: 2026-06-15

Last updated on: 2026-06-15

Assigner: Patchstack

Description

Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-15

Last Modified

2026-06-15

Generated

2026-07-06

AI Q&A

2026-06-16

EPSS Evaluated

2026-07-04

NVD

CVE-2026-39450

Affected Vendors & Products

Vendor	Product	Version / Range
funnelkit	automations	to 3.7.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

This vulnerability is a Subscriber Broken Authentication issue found in FunnelKit Automations versions up to and including 3.7.3.

Impact Analysis

The vulnerability has a CVSS v3.1 base score of 7.1, indicating a high severity. It allows an attacker with low privileges and network access to cause a high impact on availability and a low impact on integrity without requiring user interaction.

Hi! I’m here to help you understand CVE-2026-39450. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70