CVE-2026-12593

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An internal and undocumented Dashboard API endpoint POST /api/users/~/{user}/tokens fails to verify if a request to create an API token for another user has the necessary permissions. An attacker authenticated via OAuth/OIDC who knows the login name of a more privileged internal user can forge a token creation request. This allows the attacker to authenticate as that user, potentially gaining Dashboard Administrator privileges and performing all administrative actions. When combined with another weakness, this could lead to code execution on the host system with the privileges of the OS-User running the Dashboard server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.