CyberRota Analysis
AI-GeneratedThe vulnerability in sysPass version 3.2.11 allows authenticated attackers to exploit missing authorization checks, enabling them to access and manipulate account file attachments belonging to other users. This insecure direct object reference can lead to unauthorized data exposure and potential data breaches, making it critical for organizations using this software to prioritize patching. All users of sysPass should assess their exposure and implement the necessary updates to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions to enumerate and manipulate any attachment in the vault, bypassing account-level access controls entirely.