Vulnerability · Published Oct 12, 2026 · Assigned by VulDB
CVE-2026-108810tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure
Medium 5.3
In plain English
A medium-severity information exposure in tsi-dpdp-cms from tsi-coop. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument _func results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.3 is recommended to address this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tsi-coop | tsi-dpdp-cms | 0.5.00.5.10.5.2 |
Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
References
- VDB-416587 | tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure vdb-entry, technical-description
- VDB-416587 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-108810 | CVE Analysis and Report third-party-advisory
- Submit #963801 | tsi-coop tsi-dpdp-cms 0.5.0 Information Exposure via Pre-Authentication Parameter Validation third-party-advisory
- https://github.com/kavinkumarst/TSI-DPDP-CMS-API-Parameter-Schema-Enumerable-Without-Authentication/blob/main/README.md exploit
- https://github.com/tsi-coop/tsi-dpdp-cms/blob/v0.5.3/docs/security-fixes/4.md related
- https://github.com/tsi-coop/tsi-dpdp-cms/releases/tag/v0.5.3 patch
- https://github.com/tsi-coop/tsi-dpdp-cms/ product