PT-2026-82209 · Unknown · Senaite.Core

Chiara Fliegner

+2

·

CVE-2026-54569

·

Published

2026-08-26

·

Updated

2026-09-10

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SENAITE.CORE versions 2.0.0 through 2.6.0
Description An unauthenticated remote code execution issue exists in the SENAITE JSON API due to a chain of missing authorization and unsafe evaluation of input. The state-changing routes in src/bika/lims/jsonapi/update.py, including update, update many, remove, doActionFor, doActionFor many, and getusers, do not enforce the senaite.core: Access JSON API permission. Additionally, the set fields from request function in src/bika/lims/jsonapi/init.py passes raw request values for RecordsField and RecordField instances to the eval() function before write-permission checks are performed.
An anonymous attacker can discover the bika setup object identifier via the @@uuid view and send a malicious payload to the /@@API/update endpoint. This allows the execution of arbitrary Python code within the Zope worker process. The same unsafe evaluation pattern is also present in src/senaite/core/browser/fields/record.py and src/senaite/core/browser/fields/records.py. Successful exploitation can lead to the exposure or modification of laboratory data, files, and accounts, or complete service disruption.
Recommendations For versions 2.0.0 through 2.6.0:
  • Add the AccessJSONAPI permission check to every state-changing route in src/bika/lims/jsonapi/ to ensure authorization is verified before processing requests.
  • Replace the eval() function with json.loads() in src/bika/lims/jsonapi/ init .py, src/senaite/core/browser/fields/record.py, and src/senaite/core/browser/fields/records.py to prevent arbitrary code execution.
  • Remove the IDisableCSRFProtection inheritance from class ISenaiteCore in src/senaite/core/interfaces/ init .py to re-enable automatic CSRF write-detection.

Exploit

Fix

RCE

Eval Injection

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-95CWE-862

Related Identifiers

CVE-2026-54569
GHSA-JRW6-7X4Q-W25J
PYSEC-2026-3919

Affected Products

Senaite.Core