CVE-2026-65710: sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the public link creation flow. Attackers can invoke the saveCreateFromAccountAction endpoint to cause AccountService::getDataForLink to load arbitrary target accounts without AccountFilterUser restrictions, decrypt credentials using the session master key, and serialize cleartext passwords into Vault storage on the PublicLink database row, enabling subsequent unauthenticated retrieval if the generated link hash is recovered.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65710?
The severity of CVE-2026-65710 is high, with a score of 7.1.
How do I fix CVE-2026-65710?
To fix CVE-2026-65710, update sysPass to version 3.2.12 or later that includes the necessary authorization checks.
What does the CVE-2026-65710 vulnerability affect?
CVE-2026-65710 affects sysPass versions through 3.2.11, allowing unauthorized access to encrypted vault account passwords.
Who is affected by CVE-2026-65710?
Authenticated users with the PUBLICLINK_CREATE profile flag in sysPass are affected by CVE-2026-65710.
What types of attacks can CVE-2026-65710 facilitate?
CVE-2026-65710 can facilitate unauthorized decryption of vault account passwords, potentially leading to data breaches.