CVE-2026-84840
Received Received - Intake

Missing Authentication in tsi-dpdp-cms

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulDB

Description
A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.5.1 is able to mitigate this issue. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84840
EUVD
EUVD-2026-70254

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tsi-coop tsi-dpdp-cms to 0.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in TSI DPDP CMS up to version 0.5.0. It allows unauthenticated attackers to create a Super Administrator account by sending a POST request to the bootstrap setup endpoint (/api/v1/bootstrap/setup). The attack requires no prior credentials and can be executed remotely. The issue stems from missing authentication checks on the setup page and endpoint, enabling full system takeover if exploited during initial setup or after a database reset.

Detection Guidance

Check if the POST /api/v1/bootstrap/setup endpoint or /console/setup/init.html page is publicly accessible without authentication. Use tools like curl to test unauthenticated access: curl -X POST http://<target>/api/v1/bootstrap/setup -H 'Content-Type: application/json' -d '{"email":"test@example.com","name":"test","password":"test"}' or visit http://<target>/console/setup/init.html in a browser. If the endpoint responds or the page loads without requiring credentials, the system is vulnerable.

Impact Analysis

An attacker could exploit this to gain full control of the TSI DPDP CMS application. This includes creating a Super Admin account, accessing sensitive data like data fiduciaries, consent records, and personal data of Indian data principals under the DPDP Act 2023. The setup page remains publicly accessible even after initialization, posing ongoing risk if the system state is reset.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by allowing unauthorized access to sensitive personal data. Under GDPR, unauthorized access to personal data constitutes a breach requiring notification to authorities and affected individuals. HIPAA similarly mandates safeguards against unauthorized access to protected health information. The exposure of personal data under the DPDP Act 2023 further exacerbates compliance risks for organizations handling Indian data principals.

Mitigation Strategies

Upgrade tsi-dpdp-cms to version 0.5.1 or later immediately. If upgrading is not possible, restrict access to the /api/v1/bootstrap/setup endpoint and /console/setup/ directory by configuring your web server or firewall rules. Set the TSI_BOOTSTRAP_TOKEN environment variable to require a token for setup access. Disable directory listing in your web server configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84840. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart