CVE-2026-117472: URL prefix handling permits API key read-scope bypass in Psono Server
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URLPREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URLPREFIX was not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Psono Serverto a version that resolves this vulnerability.Fixed in 7.2.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Only Psono Server CE and EE deployments configured with URL_PREFIX are affected. The default configuration without URL_PREFIX is not affected.
What access does an attacker need to exploit this issue?
An attacker must be authenticated remotely and possess an API key that has write scope enabled but read scope disabled. They can use the prefixed bulk-secret-read endpoint to retrieve encrypted secret data and nonces.
Which versions are affected?
Psono Server CE and EE versions 4.0.33 through 7.2.3 are affected.