Get real-time updates on Telegram
CVE-2026-65709: sysPass 0 through 3.2.11
CVE-2026-65709. CVSS 3.1 base score 8.3 (HIGH, Vendor/CNA). EPSS 0.00388 (percentile 0.31729), scored 22-Oct-2026.
Affected technology
sysPass · 0 through 3.2.11
nuxsmin
Description’s affected range: through version 3.2.11
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as high; availability impact as low.
- CWE
- CWE-639
- CCR priority
- 33.3 /100 (P4)
- CVSS 3.1
- 8.3 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L · Vendor/CNA
- EPSS
- 0.00388 · percentile 0.3179 · 2026-10-24
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-24 15:09:16.138216+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-24 15:07:27.951960+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-65709.html