CVE-2026-65708

Name of the Vulnerable Software and Affected Versions sysPass version 3.2.11

Description An insecure direct object reference occurs due to missing authorization checks in the AccountFileController. This allows an authenticated attacker to access account file attachments for which they lack Access Control List (ACL) permissions. By providing arbitrary numeric file IDs through the download, view, delete, upload, and list actions, an attacker can enumerate and manipulate any attachment within the vault, bypassing account-level access controls.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.