CVE-2026-65709

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12

Description A missing object-level authorization issue exists in the JSON-RPC API. This allows holders of API tokens to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault, bypassing per-account access controls. The flaw occurs because the AccountController methods viewAction(), editAction(), deleteAction(), and editPassAction() can be invoked without the required AccountFilterUser checks, enabling the modification or deletion of accounts outside the permissions assigned to the token.

Recommendations Update sysPass to a version newer than 3.2.11.