CVE-2026-80349
Received Received - Intake

TarsWeb Account Impersonation via X-Forwarded-For Header

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the X-Forwarded-For header supplied by the caller. In midware/ssoMidware.js a single branch covers both the ignored-path list and the ignoreIps allowlist from config/loginConf.js, which contains the loopback address, and that branch assigns the effective account identity from the uid query parameter before falling through to the request without validating any ticket, cookie or password. A request carrying a forged X-Forwarded-For value naming the loopback address and a uid naming an existing account therefore reaches every route the console mounts as that account, including an administrator, with no credential of any kind. Those routes include user and role administration, service configuration, and package upload and deployment. Version 3.0.16 separates the two branches so that a match on the address allowlist assigns the configured default account rather than one named by the caller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80349
EUVD
EUVD-2026-66388

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tarsweb tarsweb 3.0.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

TarsWeb incorrectly trusts client-controlled headers to determine if a request comes from a trusted source. It uses the X-Forwarded-For header to identify the request address without validating the header's authenticity. This allows attackers to forge the header to impersonate local loopback addresses. Additionally, the application assigns user identities based on a uid query parameter without verifying credentials, enabling unauthorized access to sensitive routes like user administration and package deployment.

Impact Analysis

An attacker could exploit this to gain unauthorized access to administrative functions, manipulate user roles, configure services, or upload and deploy malicious packages. This could lead to complete system compromise, data theft, or service disruption. The vulnerability allows full account impersonation without any credentials.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR requires strict access controls and data protection measures, while HIPAA mandates secure authentication and authorization. The lack of proper validation and authentication could result in unauthorized access to sensitive data, leading to regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade to TarsWeb version 3.0.16 or later to separate the address allowlist and ignore-path branches, preventing forged X-Forwarded-For attacks. Ensure proxy settings explicitly trust only authorized upstream proxies and limit forwarded hops.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80349. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart