Vulnerability · Published Jul 24, 2026 · Assigned by VulnCheck

CVE-2026-65708sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController

High 8.1

In plain English

A high-severity authorization bypass via user-controlled key in sysPass from nuxsmin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 67.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions to enumerate and manipulate any attachment in the vault, bypassing account-level access controls entirely.

Affected products (as reported)

Vendor	Product	Versions
nuxsmin	sysPass	0 – through 3.2.11

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/syspass-insecure-direct-object-reference-via-accountfilecontroller third-party-advisory