ETK-2026-613Zero's internal tracking ID, independent of the CVE number.
validatedZero produced an exploit or a check.description
Versions before 5.28.0 can allow an authenticated user with delegated Certify access to create a reserved identifier and use it to expand object-creation privileges. On MySQL or MariaDB deployments, the certificate operation may also be able to replace an object selected by another user's identifier; this backend-specific outcome was inferred from the SQL path rather than dynamically verified.
mitigation
Upgrade cosmian_kms_server to 5.28.0 or later. Until upgraded, restrict Certify and replacement-capable import permissions to trusted administrators, especially on MySQL or MariaDB deployments.
fixed in 5.28.0
outcome
Check only, differential: the check fires on the vulnerable build and is silent on the patched one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-01 15:34Zghsa: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/ETK-2026-613
{ "etk_id": "ETK-2026-613", "cve_id": null, "display_id": "ETK-2026-613", "ghsa_id": "GHSA-pvw2-jxwc-95xq", "euvd_id": null, "status": "published", "anchor_state": "awaiting_cve", "title": "Authorization bypass in cosmian_kms_server certificate operations", "summary": "Versions before 5.28.0 can allow an authenticated user with delegated Certify access to create a reserved identifier and use it to expand object-creation privileges. On MySQL or MariaDB deployments, the certificate operation may also be able to replace an object selected by another user's identifier; this backend-specific outcome was inferred from the SQL path rather than dynamically verified.", "mitigation": "Upgrade cosmian_kms_server to 5.28.0 or later. Until upgraded, restrict Certify and replacement-capable import permissions to trusted administrators, especially on MySQL or MariaDB deployments.", "vendor": "other", "product": "other:cosmian_kms_server", "affected": [ { "affected_notes": [], "affected_ranges": [ "<= 5.27.1" ], "ecosystem": "other", "fixed_versions": [ "5.28.0" ], "package_name": "cosmian_kms_server", "purl": null } ], "cwes": [ 863 ], "cvss_score": 7, "cvss_src": "ethiack_provisional", "cvss_vector": null, "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "differential", "exploit": false, "pipeline_minutes": 14.059656533333333, "t0_at": null, "signals": { "check": { "at": "2026-10-05T02:12:58.434772+00:00", "days": -16.219283453009258, "is_lower_bound": true, "measured_at": "2026-10-21T07:28:44.547373+00:00", "url": null }, "trigger_signal": { "at": "2026-10-01T15:34:22+00:00", "days": -19.662760707314813, "is_lower_bound": true, "measured_at": "2026-10-21T07:28:44.547373+00:00", "url": "https://github.com/Cosmian/kms/security/advisories/GHSA-pvw2-jxwc-95xq" } } }
published 2026-10-05 01:58Z
last change 2026-10-21 07:05Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.