CVE-2026-71252

Received Received - Intake

Unauthenticated Admin State Changes in Toner Management

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description

toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-16

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-15

NVD

CVE-2026-71252

EUVD

EUVD-2026-53325

Affected Vendors & Products

Vendor	Product	Version / Range
toner-management	toner_management	From authenticated_admin_session (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves toner-management's admin handlers for database operations (add.php, edit.php, delete.php) lacking authentication or authorization checks. Unauthenticated attackers could directly invoke these handlers to create, modify, or delete application data.

Detection Guidance

Check web server access logs for unusual POST requests to admin/toners/add.php, admin/toners/edit.php, admin/toners/delete.php, and similar paths under admin/toner-brands, admin/printers. Look for requests without valid session cookies or authentication headers.

Impact Analysis

An attacker could manipulate or delete critical printer, toner, or brand data, disrupting operations. Sensitive information might be exposed if modified, and system integrity could be compromised due to unauthorized changes.

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion, violating integrity and confidentiality requirements in GDPR and HIPAA. Non-compliance risks include fines and legal penalties due to inadequate access controls.

Mitigation Strategies

Apply the vendor's patch that enforces authenticated admin session checks for state-changing handlers. Temporarily restrict access to admin directories via web server rules until patched. Monitor for unauthorized database changes.

Hi! I’m here to help you understand CVE-2026-71252. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70