Vulnerability · Published Jul 24, 2026 · Assigned by VulnCheck

CVE-2026-65709sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API

High 8.3

In plain English

A high-severity authorization bypass via user-controlled key in sysPass from nuxsmin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.4%top 66.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions.

Affected products (as reported)

Vendor	Product	Versions
nuxsmin	sysPass	0 – through 3.2.11

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/syspass-missing-object-level-authorization-via-json-rpc-api third-party-advisory