CVE-2026-65708: sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController
sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions to enumerate and manipulate any attachment in the vault, bypassing account-level access controls entirely.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sysPass 3.2to a version that resolves this vulnerability.Fixed in 3.2.11 - Compensating control
Restrict access to sysPass attachment/file upload/download/view/delete/list endpoints so that only authorized users can reach AccountFileController functionality, mitigating enumeration and manipulation of attachments via arbitrary numeric file IDs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65708?
CVE-2026-65708 has a severity score of 8.6, indicating it is a high-risk vulnerability.
How do I fix CVE-2026-65708?
To fix CVE-2026-65708, update sysPass to the latest version that addresses the insecure direct object reference vulnerability.
What causes CVE-2026-65708?
CVE-2026-65708 is caused by missing authorization checks in the AccountFileController, allowing unauthorized access to account file attachments.
Who is impacted by CVE-2026-65708?
Any user of sysPass version 3.2.11 or earlier may be impacted by CVE-2026-65708 if they are authenticated but lack proper ACL permissions.
What type of vulnerability is CVE-2026-65708?
CVE-2026-65708 is classified as an insecure direct object reference vulnerability.