CVE-2026-129110

{
  "etk_id": "ETK-2026-4402",
  "cve_id": "CVE-2026-129110",
  "display_id": "CVE-2026-129110",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-125526",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in sysPass installation handler",
  "summary": "sysPass 3.0.1 through 3.2.11 does not require authentication for a critical installation operation after the product has already been installed. An unauthenticated attacker able to reach the affected handler can reconfigure the instance, create an administrator account, and may obtain command execution.",
  "mitigation": "Restrict unauthenticated network access to sysPass, especially the installation handler, using firewall or reverse-proxy rules. No fixed version is recorded; monitor vendor guidance and upgrade promptly when a corrected release is available.",
  "vendor": "nuxsmin",
  "product": "sysPass",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.1, <= 3.2.11"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "sysPass",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.10180726666667,
  "t0_at": "2026-11-13T15:46:29.636000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-11-13T22:59:38+00:00",
      "days": 0.30079125,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T15:46:29.636000+00:00",
      "url": "https://github.com/psylinux/CVE-2026-129110-sysPass"
    },
    "trigger_signal": {
      "at": "2026-11-13T15:46:29.636000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T15:46:29.636000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-129110"
    }
  }
}