CVE-2026-84839
Received Received - Intake

Missing Authentication in tsi-dpdp-cms Admin Console

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulDB

Description
A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.1 can resolve this issue. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84839
EUVD
EUVD-2026-70253

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tsi-coop tsi-dpdp-cms to 0.5.0 (inc)
tsi-coop tsi-dpdp-cms 0.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84839 is a missing authentication vulnerability in the TSI DPDP CMS application up to version 0.5.0. It allows unauthenticated remote access to all administrator and Data Protection Officer (DPO) console pages via the /console/ path. The issue occurs because the application relies on client-side JavaScript for authentication, which can be bypassed by non-browser tools like curl or wget. This exposes sensitive administrative functions and internal API details.

Detection Guidance

Check if any of the 17 admin or DPO console pages under /console/admin/*.html or /console/dpo/*.html are accessible without authentication by sending HTTP GET requests to those paths. Use tools like curl or wget to test access. If pages return HTTP 200 without requiring credentials, the vulnerability is present.

Impact Analysis

An attacker could access sensitive administrative functions and data without authentication. This includes managing breach reporting, ROPA, grievances, and compliance tracking. The exposed internal API paths and token formats could enable targeted attacks against personal data, potentially leading to data breaches or regulatory violations.

Compliance Impact

This vulnerability likely violates data protection regulations like GDPR and HIPAA by exposing sensitive personal data to unauthorized access. The DPDP Act, which this CMS is designed to comply with, requires strict access controls for personal data processing. The lack of authentication undermines these requirements, increasing the risk of non-compliance and potential penalties.

Mitigation Strategies

Upgrade the tsi-dpdp-cms component to version 0.5.1 or later, which includes the ConsoleAuthFilter to enforce server-side authentication for console pages. Verify that unauthenticated requests to /console/admin/* or /console/dpo/* paths are redirected or denied access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart