CVE-2026-65709
Received Received - Intake

sysPass 3.2.11 Missing Object-Level Authorization in JSON-RPC API

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-65709
EUVD
EUVD-2026-48715

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
syspass syspass 3.2.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

sysPass version 3.2.11 has a missing object-level authorization flaw in its JSON-RPC API. API token holders can abuse AccountController methods like viewAction, editAction, deleteAction, and editPassAction to access, modify, or delete accounts beyond their assigned permissions. This occurs because the system lacks proper AccountFilterUser checks.

Detection Guidance

To detect this vulnerability, monitor API calls to sysPass JSON-RPC endpoints for suspicious activities. Check for unauthorized account metadata enumeration, password overwrites, or deletions using methods like account/view, account/edit, account/delete, and account/editPass. Compare API token owner visibility with account IDs in these methods and review historical API logs for anomalies.

Impact Analysis

If you use sysPass 3.2.11, an attacker with a valid API token could enumerate account details, overwrite passwords, or delete accounts across the entire vault. This could lead to unauthorized access, data loss, or complete system compromise depending on the token's privileges.

Compliance Impact

This vulnerability likely violates GDPR (data protection) and HIPAA (health data privacy) due to unauthorized access to sensitive account metadata and passwords. It undermines access control requirements, potentially leading to non-compliance and legal penalties.

Mitigation Strategies

Upgrade sysPass to a version beyond 3.2.11 where object-level authorization checks are enforced for API token holders. Review and restrict API token permissions to the minimum required access. Monitor account activity for unauthorized modifications or deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65709. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart