CVE-2026-71252
Received Received - Intake

Unauthenticated Admin State Changes in Toner Management

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views. An unauthenticated remote attacker could invoke these handlers directly to create, modify, or destroy application data. The vendor has since merged a fix requiring an authenticated admin session before any such handler proceeds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71252
EUVD
EUVD-2026-53325

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
toner-management toner_management From authenticated_admin_session (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves toner-management's admin handlers for database operations (add.php, edit.php, delete.php) lacking authentication or authorization checks. Unauthenticated attackers could directly invoke these handlers to create, modify, or delete application data.

Detection Guidance

Check web server access logs for unusual POST requests to admin/toners/add.php, admin/toners/edit.php, admin/toners/delete.php, and similar paths under admin/toner-brands, admin/printers. Look for requests without valid session cookies or authentication headers.

Impact Analysis

An attacker could manipulate or delete critical printer, toner, or brand data, disrupting operations. Sensitive information might be exposed if modified, and system integrity could be compromised due to unauthorized changes.

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion, violating integrity and confidentiality requirements in GDPR and HIPAA. Non-compliance risks include fines and legal penalties due to inadequate access controls.

Mitigation Strategies

Apply the vendor's patch that enforces authenticated admin session checks for state-changing handlers. Temporarily restrict access to admin directories via web server rules until patched. Monitor for unauthorized database changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71252. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart