Craftplan Credential Exposure via Broken Access Control

Executive Summary

CVE-2026-76876 is a broken access control vulnerability in Craftplan versions before 0.5.1. It allows unauthenticated attackers to read sensitive credentials like SMTP passwords and email API keys by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request with a valid record ID to retrieve decrypted credentials due to an always-allow authorization check that bypasses identity verification.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Craftplan instance is running a version before 0.5.1. Use commands like curl to send a GET request to the settings API endpoint with a valid record ID and inspect responses for exposed credentials such as SMTP passwords or email API keys.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access sensitive credentials, potentially leading to unauthorized email sending, data breaches, or further system compromise. Attackers could use exposed SMTP passwords or API keys to send phishing emails, access email accounts, or manipulate system settings.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. Exposure of credentials or email content could result in regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Craftplan to version 0.5.1 or later. This version restricts access to sensitive settings and prevents credential exposure. Verify the update by checking the version and testing API responses for unauthorized access.

Useful 0 Not Useful 0