CVE-2026-65708
Received Received - Intake

Insecure Direct Object Reference in sysPass 3.2.11 Allowing Unauthorized File Access

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions to enumerate and manipulate any attachment in the vault, bypassing account-level access controls entirely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-65708
EUVD
EUVD-2026-48714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
syspass syspass 3.2.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

sysPass version 3.2.11 has an insecure direct object reference vulnerability. Authenticated attackers can access account file attachments they are not authorized to see by manipulating file IDs in requests. The vulnerability exists because the AccountFileController does not properly check permissions before allowing actions like download, view, delete, upload, or list on attachments.

Detection Guidance

This vulnerability can be detected by checking for unauthorized access to account file attachments in sysPass version 3.2.11. Monitor logs for suspicious download, view, delete, upload, or list actions on arbitrary numeric file IDs. Verify if users can access files outside their assigned account permissions.

Impact Analysis

An attacker with valid credentials could steal sensitive files from other accounts, delete or modify files they should not access, or upload malicious files. This could lead to data breaches, loss of confidential information, or unauthorized changes to stored data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data confidentiality and access controls. Organizations using sysPass may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade sysPass to a patched version beyond 3.2.11. Review and restrict file attachment access controls to enforce proper ACL permissions. Audit logs for any signs of exploitation and revoke unauthorized access if detected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65708. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart