Insecure Permissions in ics-park v2.0

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: MITRE

Description

Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-67687

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Permissions issue in the ics-park software version 2.0. It allows a remote attacker to gain elevated privileges by exploiting improper access controls in two specific endpoints: /system/role/save in RoleController.java and system/user/update in UserController.java.

Impact Analysis

An attacker could exploit this to escalate their privileges, potentially gaining unauthorized administrative access to the system. This could lead to full control over user roles, permissions, and sensitive data within the application.

Mitigation Strategies

Immediately restrict access to the /system/role/save and system/user/update endpoints. Review and update permissions for RoleController.java and UserController.java to enforce strict access controls. Monitor network traffic for unauthorized access attempts to these endpoints.

Hi! I’m here to help you understand CVE-2026-67687. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70