PT-2026-60495 · Microsoft · Ufo
CVE-2026-54568
·
Published
2026-07-16
·
Updated
2026-07-16
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft UFO versions 3.0.0 through 3.0.5
Description
A client connected to the WebSocket server as a DEVICE can request the server-side
system info of another device by providing its target id. This occurs because the handle device info request() and get device info() functions in ufo/server/ws/handler.py fail to enforce object-level authorization boundaries or the constellation-only role.Recommendations
Update to version 3.0.6.
Exploit
Fix
IDOR
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ufo