CVE-2026-110972

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/10/CVE-2026-110970
https://www.zus.pl/firmy/program-platnik/o-programie-platnik

Configurations

No configuration.

History

30 Oct 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-30 12:16

Updated : 2026-10-30 19:39

NVD link : CVE-2026-110972

Mitre link : CVE-2026-110972

CVE.ORG link : CVE-2026-110972

JSON object : View

Products Affected

No product.

CWE

CWE-603

Use of Client-Side Authentication

{"id": "CVE-2026-110972", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-110972", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T15:26:06.783259Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "Zak\u0142ad Ubezpiecze\u0144 Spo\u0142ecznych", "product": "P\u0142atnik", "versions": [{"status": "affected", "changes": [{"at": "metric 242", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "10.02.002"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-30T12:16:34.803", "references": [{"url": "https://cert.pl/posts/2026/10/CVE-2026-110970", "source": "cvd@cert.pl"}, {"url": "https://www.zus.pl/firmy/program-platnik/o-programie-platnik", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-603"}]}], "descriptions": [{"lang": "en", "value": "P\u0142atnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.\n\n\n\nThis issue was fixed\u00a0in metric 242 in version 10.02.002."}], "lastModified": "2026-10-30T19:39:14.897", "sourceIdentifier": "cvd@cert.pl"}

CVE-2026-110972

JSON object

Attach tags to CVE-2026-110972

Attach tags to `CVE-2026-110972`