CVE-2026-36453

Received Received - Intake

Insecure Direct Object Reference in Rhymix Before 2.1.31

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: MITRE

Description

Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-36453

Affected Vendors & Products

Vendor	Product	Version / Range
rhymix	rhymix	to 2.1.31 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-425	The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Attack-Flow Graph

Executive Summary

Rhymix before version 2.1.31 has an insecure direct object reference vulnerability. This means attackers can access arbitrary files by manipulating extra variables in the application.

Impact Analysis

An attacker could read sensitive files on the server, leading to unauthorized access to confidential data. This may include configuration files, user data, or other critical system information.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting personal and health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update Rhymix to version 2.1.31 or later to address the insecure direct object reference vulnerability.

Hi! I’m here to help you understand CVE-2026-36453. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70