Vulnerability · Published Sep 2, 2026 · Assigned by VulDB

CVE-2026-84840tsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication

Medium 6.5

In plain English

A medium-severity missing authentication in tsi-dpdp-cms from tsi-coop. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.8%top 43.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.5.1 is able to mitigate this issue. Upgrading the affected component is recommended.

Affected products (as reported)

Vendor	Product	Versions
tsi-coop	tsi-dpdp-cms	0.10.20.30.40.5.0

Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C

References

VDB-398082 | tsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication vdb-entry
VDB-398082 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-84840 | CVE Analysis and Report third-party-advisory
Submit #885658 | TSI Coop TSI DPDP CMS 0.4.8 Missing Authentication third-party-advisory
https://github.com/mano257200/TSI-DPDP-CMS-Unauthenticated-Super-Admin-Bootstrap-Endpoint/blob/main/README.md exploit
https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/docs/security-fixes/2.md related
https://github.com/tsi-coop/tsi-dpdp-cms/releases/tag/v0.5.1 patch
https://github.com/tsi-coop/tsi-dpdp-cms/ product