CVE-2026-27553: Information Disclosure via Schema Path Manipulation
Published Sep 16, 2026
·Updated
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes.
Event History
Sep 16, 2026
CVE Published
via MITRE·07:49 AM
Data Sourced
via MITRE·07:49 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Instances that expose the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint to remote users are affected if a low-privileged account can authenticate and obtain a valid user cookie.
2
What does an attacker need to exploit it?
The attacker needs network access, a valid cookie for a low-privileged user account, and the ability to manipulate the schema path parameter sent to the diagnostics endpoint. No user interaction is required.
3
What information can be disclosed?
Successful exploitation can disclose all user password hashes.