CVE-2026-65709 nuxsmin CVE debrief

Who should care

Security teams and administrators responsible for sysPass installations should be aware of this vulnerability, as it allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. This vulnerability has a high CVSS score of 8.7, indicating a high severity level, and requires immediate attention to prevent potential operational impact.

Technical summary

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions. This vulnerability has a high CVSS score of 8.7, indicating a high severity level. The technical impact includes the potential for attackers to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without proper authorization.

Defensive priority

High priority due to the high CVSS score of 8.7 and the potential for attackers to modify or delete accounts without proper authorization.

Recommended defensive actions

• Review and update sysPass installations to ensure they are running a version with the necessary patches.
• Restrict API token permissions to the minimum required for each user.
• Monitor API activity for suspicious account modifications or deletions.
• Implement additional access controls to enforce per-account authorization.
• Conduct a thorough review of affected systems and potential mitigations.
• Perform compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in sysPass through version 3.2.11, which contains a missing object-level authorization vulnerability in the JSON-RPC API. This allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Further investigation is needed to determine the full scope of affected systems, potential mitigations, and to verify the accuracy of the information provided. Defensive verification tasks should include reviewing sysPass installations, restricting API token permissions, and monitoring API activity for suspicious account modifications or deletions.

Official resources