CVE-2026-84841
Received Received - Intake

Client-Side Enforcement Flaw in tsi-dpdp-cms

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulDB

Description
A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.1 is able to resolve this issue. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84841
EUVD
EUVD-2026-70255

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
tsi-coop tsi-dpdp-cms to 0.5.0 (inc)
tsi-coop tsi-dpdp-cms 0.5.1
tsi-coop tsi-dpdp-cms to 0.5.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84841 is a client-side-only authentication flaw in tsi-dpdp-cms up to 0.5.0. The application served all 17 admin and DPO console pages with HTTP 200 to any request, bypassing server-side authentication. Only a client-side JavaScript check for an authToken in local storage redirected unauthenticated users, but this occurred after the full page was delivered. Attackers could use tools like curl or Burp Suite to access full page sources, including internal API endpoints and sensitive logic.

Detection Guidance

To detect this vulnerability, check if any of the 17 admin or DPO console pages (/console/admin/*.html or /console/dpo/*.html) return HTTP 200 with full content without authentication. Use commands like curl to request these pages directly. Example: curl -i http://<target>/console/admin/dashboard.html. If the response includes full page content instead of a redirect, the system is vulnerable.

Impact Analysis

This vulnerability allows unauthenticated attackers to access sensitive console pages and internal API endpoints by sending direct HTTP requests. While it does not grant unauthorized access to sensitive functionality due to independent server-side API authentication, it exposes over 100KB of application logic, 12+ REST endpoints, and role-routing details. This could lead to information disclosure, API surface exposure, and potential downstream leaks of business logic or tokens.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA, which mandate strict access controls and protection of sensitive data. The exposure of internal API endpoints, business logic, and authentication tokens could result in unauthorized data access or processing, leading to regulatory penalties. The system's role as a consent management tool for India's DPDP Act further exacerbates compliance risks due to potential breaches of personal data handling protocols.

Mitigation Strategies

Upgrade to version 0.5.1 or later immediately. Verify that the new ConsoleAuthFilter is active by checking web.xml for mappings to /console/admin/* and /console/dpo/*.html. Ensure server-side session validation is enforced for these paths. Disable directory listing on the setup endpoint (/api/v1/bootstrap/setup) and require a bootstrap token for first-run setup.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84841. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart