CVE-2026-76876

Name of the Vulnerable Software and Affected Versions Craftplan versions prior to 0.5.1

Description Broken access control allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. By sending a GET request to the settings API endpoint with a valid record ID, attackers can retrieve decrypted SMTP passwords, email API keys, and email API secrets. This occurs because the read policy uses an always-allow authorization check that bypasses all identity verification.

Recommendations Update Craftplan to version 0.5.1 or later.