CVE-2026-65710 nuxsmin CVE debrief

Who should care

sysPass users and administrators should be aware of this vulnerability and take immediate action to protect their systems. This vulnerability can be exploited by authenticated users with the PUBLICLINK_CREATE profile flag, and it allows them to access sensitive information without proper authorization.

Technical summary

The vulnerability exists in the public link creation flow of sysPass, where the absence of AccountAcl checks allows an authenticated user with the PUBLICLINK_CREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password. The saveCreateFromAccountAction endpoint is used to exploit this vulnerability, allowing an attacker to load arbitrary target accounts, decrypt credentials using the session master key, and serialize cleartext passwords into Vault storage on the PublicLink database row.

Defensive priority

High

Recommended defensive actions

• Update sysPass to a version that fixes the missing authorization vulnerability
• Restrict access to the PUBLICLINK_CREATE profile flag to only authorized users
• Monitor system logs for suspicious activity related to the saveCreateFromAccountAction endpoint
• Implement additional security controls, such as multi-factor authentication and account lockout policies
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-24T17:17:34.713Z and was last modified on 2026-07-27T20:36:13.407Z. The NVD entry is currently Deferred. The vulnerability exists in sysPass through version 3.2.11. Authenticated users with the PUBLICLINK_CREATE profile flag can exploit the absence of AccountAcl checks in the public link creation flow to trigger unauthorized decryption and persistent storage of any vault account's password. The saveCreateFromAccountAction endpoint allows loading arbitrary target accounts, decrypting credentials using the session master key, and serializing cleartext passwords into Vault storage on the PublicLink database row, enabling subsequent unauthenticated retrieval if the generated link hash is recovered. Evidence is limited, and defenders should verify affected scope and vendor guidance.

Official resources