Vulnerability · Published Apr 22, 2026 · Assigned by INCIBE

CVE-2026-5749Inadequate access control vulnerability in Fullstep

High 8.7

In plain English

A high-severity missing authentication in Fullstep from Fullstep. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain a valid JWT token with which to interact with authenticated API resources. Successful exploitation of this vulnerability could allow an unauthenticated attacker to compromise the confidentiality of the affected resource, provided they have a valid token with which to interact with the API.

Affected products (as reported)

Vendor	Product	Versions
Fullstep	Fullstep	5

Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fullstep patch