PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40794 myCred CVE debrief

A Subscriber Broken Access Control vulnerability was found in myCred plugin versions <= 3.0.3. This CVE has a CVSS score of 6.5 and a CVSS severity of MEDIUM. The vulnerability was published on [2026-06-15T21:16:51.783Z](https://www.cve.org/CVERecord?id=CVE-2026-40794) and last modified on [2026-06-15T21:24:32.790Z](https://www.cve.org/CVERecord?id=CVE-2026-40794). The vulnerability is categorized under CWE-862. For more information, refer to [CVE-2026-40794 CVE record](resourceLinkAnnotations:cve-org) and [CVE-2026-40794 NVD detail](resourceLinkAnnotations:nvd).

Vendor
myCred
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-15
Advisory published
2026-06-15
Advisory updated
2026-06-15

Who should care

Users of myCred plugin versions <= 3.0.3 should be aware of this Subscriber Broken Access Control vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability has a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. It allows an attacker to perform unauthorized actions with high impact on integrity.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update myCred plugin to a version greater than 3.0.3.
  • Refer to [Mitigation or vendor reference](resourceLinkAnnotations:ref-4) for more information on mitigation and patches.

Evidence notes

The vendor of this product is currently listed as Unknown Vendor. The canonical source is listed as reference_domain_weak with low confidence and needs review. The evidence for the vendor is from Patchstack.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40794 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40794

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40794 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40794

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.