CVE-2026-129110: sysPass 3.0.1 through 3.2.11 Unauthenticated Reinstallation RCE via install/install
sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite config.xml, point the application at an attacker-controlled database, create an administrator account, and plant serialized PublicLink gadget chains triggered via account/viewLink to execute commands.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated compromise?
sysPass versions 3.0.1 through 3.2.11 are affected. An attacker can reach the vulnerable install/install handler remotely without authentication.
What does an attacker need to do to achieve command execution?
The attacker can POST to install/install to reinstall the application, overwrite config.xml, use an attacker-controlled database, and create an administrator account. They can then plant serialized PublicLink gadget chains that are triggered through account/viewLink to execute commands.
Are confidentiality, integrity, and availability all at risk?
Yes. The provided severity vector rates confidentiality, integrity, and availability impact as high, and the described attack enables administrative account creation, configuration replacement, and command execution.