CVE-2026-19376: Uasoft Badaso File API api.php class permission
A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19376?
The severity of CVE-2026-19376 is classified as high with a CVSS score of 7.3.
What impact does CVE-2026-19376 have on the Uasoft Badaso system?
CVE-2026-19376 leads to permission issues in the File API component, allowing unauthorized access.
How do I fix CVE-2026-19376?
To fix CVE-2026-19376, update Uasoft Badaso to a patched version that addresses the vulnerability.
Is CVE-2026-19376 an attack vector that can be exploited remotely?
Yes, CVE-2026-19376 can be exploited remotely, making it a significant risk.
What components of Uasoft Badaso are affected by CVE-2026-19376?
CVE-2026-19376 specifically affects the ApiRequest::class function within the src/Routes/api.php file.