CVE-2026-35063: Missing Authorization in OpenPLC_V3
OpenPLCV3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete any other user, including administrators, by specifying their user ID or they can create new accounts with role=admin, escalating to full administrator access.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35063?
CVE-2026-35063 has a high severity rating due to its potential to allow unauthorized account management actions.
How do I fix CVE-2026-35063?
To fix CVE-2026-35063, ensure that the OpenPLC_V3 API properly verifies the roles of authenticated users before allowing sensitive actions.
What are the potential impacts of CVE-2026-35063?
The impacts of CVE-2026-35063 include unauthorized user account deletions and the potential creation of accounts with elevated privileges.
Who is affected by CVE-2026-35063?
CVE-2026-35063 affects users of OpenPLC_V3 who rely on its REST API for account management.
What version of OpenPLC is vulnerable to CVE-2026-35063?
CVE-2026-35063 affects all versions of OpenPLC_V3 that are deployed without proper role verification.