CVE-2026-5652: Authorization Bypass Through User-Controlled Key in Crafty Controller
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5652?
CVE-2026-5652 is classified as a high-severity vulnerability due to its potential for unauthorized user modifications.
How do I fix CVE-2026-5652?
To fix CVE-2026-5652, implement proper API permissions validation in the Users API component of Crafty Controller.
Who is affected by CVE-2026-5652?
Remote, authenticated users of the Crafty Controller who interact with the Users API are affected by CVE-2026-5652.
What type of vulnerability is CVE-2026-5652?
CVE-2026-5652 is an insecure direct object reference vulnerability that allows unauthorized user modifications.
What actions can be performed by exploiting CVE-2026-5652?
Exploiting CVE-2026-5652 allows an attacker to perform unauthorized user modification actions within Crafty Controller.