CVE-2026-13483

A flaw has been found in arc53 DocsGPT up to 0.18.0. The affected element is the function encrypt_credentials of the file application/security/encryption.py of the component Credential Storage. This manipulation causes insufficient verification of data authenticity. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

CVSS v3 3.1 LOW
CVSS v2.0 2.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:S/C:N/I:P/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/arc53/DocsGPT/
https://github.com/arc53/DocsGPT/issues/2503
https://github.com/arc53/DocsGPT/pull/2331
https://vuldb.com/cve/CVE-2026-13483
https://vuldb.com/submit/837646
https://vuldb.com/vuln/374480
https://vuldb.com/vuln/374480/cti

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Se ha encontrado un fallo en arc53 DocsGPT hasta la versión 0.18.0. El elemento afectado es la función encrypt_credentials del archivo application/security/encryption.py del componente Almacenamiento de Credenciales. Esta manipulación provoca una verificación insuficiente de la autenticidad de los datos. Es posible iniciar el ataque de forma remota. La complejidad de un ataque es bastante alta. La explotabilidad se describe como difícil. El exploit ha sido publicado y puede ser utilizado. La solicitud de extracción para solucionar este problema espera aceptación.

Information

Published : 2026-06-28 07:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-13483

Mitre link : CVE-2026-13483

CVE.ORG link : CVE-2026-13483

JSON object : View

Products Affected

No product.

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2026-13483", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13483", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T13:01:31.061832Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:arc53:docsgpt:*:*:*:*:*:*:*:*"], "vendor": "arc53", "modules": ["Credential Storage"], "product": "DocsGPT", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.2"}, {"status": "affected", "version": "0.3"}, {"status": "affected", "version": "0.4"}, {"status": "affected", "version": "0.5"}, {"status": "affected", "version": "0.6"}, {"status": "affected", "version": "0.7"}, {"status": "affected", "version": "0.8"}, {"status": "affected", "version": "0.9"}, {"status": "affected", "version": "0.10"}, {"status": "affected", "version": "0.11"}, {"status": "affected", "version": "0.12"}, {"status": "affected", "version": "0.13"}, {"status": "affected", "version": "0.14"}, {"status": "affected", "version": "0.15"}, {"status": "affected", "version": "0.16"}, {"status": "affected", "version": "0.17"}, {"status": "affected", "version": "0.18.0"}]}]}], "published": "2026-06-28T07:16:21.417", "references": [{"url": "https://github.com/arc53/DocsGPT/", "source": "cna@vuldb.com"}, {"url": "https://github.com/arc53/DocsGPT/issues/2503", "source": "cna@vuldb.com"}, {"url": "https://github.com/arc53/DocsGPT/pull/2331", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-13483", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/837646", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/374480", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/374480/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in arc53 DocsGPT up to 0.18.0. The affected element is the function encrypt_credentials of the file application/security/encryption.py of the component Credential Storage. This manipulation causes insufficient verification of data authenticity. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Se ha encontrado un fallo en arc53 DocsGPT hasta la versi\u00f3n 0.18.0. El elemento afectado es la funci\u00f3n encrypt_credentials del archivo application/security/encryption.py del componente Almacenamiento de Credenciales. Esta manipulaci\u00f3n provoca una verificaci\u00f3n insuficiente de la autenticidad de los datos. Es posible iniciar el ataque de forma remota. La complejidad de un ataque es bastante alta. La explotabilidad se describe como dif\u00edcil. El exploit ha sido publicado y puede ser utilizado. La solicitud de extracci\u00f3n para solucionar este problema espera aceptaci\u00f3n."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "cna@vuldb.com"}