CVE-2026-76876: Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Craftplan deployments running versions before 0.5.1 are exposed if the Settings API endpoint is reachable by an attacker. No authentication is required to exploit the affected read policy.
What does an attacker need to retrieve the disclosed credentials?
An attacker needs to send a GET request to the settings API endpoint using a valid settings record ID. The authorization check unconditionally allows the read request, bypassing identity verification.
What information can be exposed?
The affected endpoint can return decrypted SMTP passwords, email API keys, and email API secrets.
How can I remediate this vulnerability?
Upgrade Craftplan to version 0.5.1 or later. The issue affects versions before 0.5.1.