CVE-2026-71252: toner-management: Unauthenticated State-Changing Admin Actions
toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views. An unauthenticated remote attacker could invoke these handlers directly to create, modify, or destroy application data. The vendor has since merged a fix requiring an authenticated admin session before any such handler proceeds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update toner-management so each state-changing admin handler (add.php, edit.php, delete.php and related admin subdirectory handlers under admin/toners, admin/toner-brands, and admin/printers) verifies an authenticated admin session before proceeding with INSERT/UPDATE/DELETE database operations.
toner-management admin state-changing handlers (add.php, edit.php, delete.php; under admin/toners, admin/toner-brands, admin/printers and related admin subdirectories) Require authenticated admin session before executing INSERT/UPDATE/DELETE = authenticated_admin_session_required
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71252?
CVE-2026-71252 has a high severity rating of 8.2.
How do I fix CVE-2026-71252?
To fix CVE-2026-71252, implement proper authentication and authorization checks for state-changing actions in toner-management.
What are the potential impacts of CVE-2026-71252?
CVE-2026-71252 can lead to unauthorized database modifications, allowing malicious users to add, edit, or delete records.
Which components are affected by CVE-2026-71252?
CVE-2026-71252 affects the admin state-changing handlers in toner-management, specifically add.php, edit.php, and delete.php.
Is user interaction required for exploiting CVE-2026-71252?
No, CVE-2026-71252 can be exploited without user interaction, as it does not require authentication.