PT-2026-25669 · Wakyma · Wakyma Application Web
CVE-2026-3020
·
Publicado
2026-03-16
·
Atualizado
2026-05-19
CVSS v4.0
8.6
Alta
| Vetor | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
versions prior to 2026-3020
Description
An identity based authorization bypass issue (IDOR) exists that could allow an attacker to modify data associated with legitimate user accounts. Specifically, an attacker may be able to change a victim's email address, validate the new email address, and request a new password. Successful exploitation could lead to complete account takeover of other users. The affected API endpoints and variables are not specified. The
validateEmail() and requestPasswordReset() functions may be involved.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
IDOR
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wakyma Application Web