CVE-2026-76876

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/puemos/craftplan/commit/317acd584b68887f592dc3b97f47703dd63b1bf
https://github.com/puemos/craftplan/releases/tag/v0.5.1
https://www.vulncheck.com/advisories/craftplan-broken-access-control-information-disclosure-via-settings-api

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Craftplan anterior a 0.5.1 contiene una vulnerabilidad de control de acceso roto que permite a atacantes no autenticados leer credenciales sensibles explotando una política de autorización incondicional en el recurso de Configuración. Los atacantes pueden enviar una solicitud GET al endpoint de la API de configuración con un ID de registro válido para recuperar contraseñas SMTP descifradas, claves API de correo electrónico y secretos API de correo electrónico debido a que la política de lectura utiliza una verificación de autorización de 'permitir siempre' que omite toda verificación de identidad.

Information

Published : 2026-08-21 20:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-76876

Mitre link : CVE-2026-76876

CVE.ORG link : CVE-2026-76876

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-76876", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76876", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T17:17:18.902565Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/puemos/craftplan", "vendor": "puemos", "product": "craftplan", "versions": [{"status": "affected", "version": "0", "lessThan": "0.5.1", "versionType": "semver"}], "packageURL": "pkg:github/puemos/craftplan", "defaultStatus": "affected"}]}], "published": "2026-08-21T20:16:44.680", "references": [{"url": "https://github.com/puemos/craftplan/commit/317acd584b68887f592dc3b97f47703dd63b1bf", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/puemos/craftplan/releases/tag/v0.5.1", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/craftplan-broken-access-control-information-disclosure-via-settings-api", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification."}, {"lang": "es", "value": "Craftplan anterior a 0.5.1 contiene una vulnerabilidad de control de acceso roto que permite a atacantes no autenticados leer credenciales sensibles explotando una pol\u00edtica de autorizaci\u00f3n incondicional en el recurso de Configuraci\u00f3n. Los atacantes pueden enviar una solicitud GET al endpoint de la API de configuraci\u00f3n con un ID de registro v\u00e1lido para recuperar contrase\u00f1as SMTP descifradas, claves API de correo electr\u00f3nico y secretos API de correo electr\u00f3nico debido a que la pol\u00edtica de lectura utiliza una verificaci\u00f3n de autorizaci\u00f3n de 'permitir siempre' que omite toda verificaci\u00f3n de identidad."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "disclosure@vulncheck.com"}