CVE-2026-65710
Received Received - Intake

sysPass Missing Authorization in Vault Password Decryption

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINK_CREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the public link creation flow. Attackers can invoke the saveCreateFromAccountAction endpoint to cause AccountService::getDataForLink to load arbitrary target accounts without AccountFilterUser restrictions, decrypt credentials using the session master key, and serialize cleartext passwords into Vault storage on the PublicLink database row, enabling subsequent unauthenticated retrieval if the generated link hash is recovered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-65710
EUVD
EUVD-2026-48716

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
syspass syspass 3.2.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

sysPass version 3.2.11 has a missing authorization flaw where authenticated users with PUBLICLINK_CREATE permissions can decrypt and store any vault account password without proper access checks. By exploiting the saveCreateFromAccountAction endpoint, attackers can load arbitrary accounts, decrypt credentials using the session master key, and save passwords in cleartext to the PublicLink database, enabling later unauthorized retrieval if the link hash is obtained.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized password decryption and storage in sysPass. Look for suspicious activity in the PublicLink database table for serialized cleartext passwords or unusual account access patterns. Review logs for calls to the saveCreateFromAccountAction endpoint by users with PUBLICLINK_CREATE privileges.

Impact Analysis

This vulnerability allows unauthorized access to sensitive passwords stored in the vault. Attackers with limited access could escalate privileges, steal credentials, and potentially gain control over accounts or systems relying on those passwords. Persistent storage of decrypted passwords increases long-term risk of exposure.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA by enabling unauthorized access to sensitive personal or health information stored as passwords. It undermines confidentiality controls, risking non-compliance with privacy principles and potential regulatory penalties.

Mitigation Strategies

Upgrade sysPass to a patched version beyond 3.2.11. Temporarily revoke PUBLICLINK_CREATE privileges from non-admin users. Monitor PublicLink database tables for unauthorized cleartext password storage. Implement strict access controls and audit all endpoint calls to saveCreateFromAccountAction.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65710. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart