CVE-2026-21854

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21854", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T16:44:16.366Z", "datePublished": "2026-01-07T18:14:59.375Z", "dateUpdated": "2026-01-07T18:41:47.562Z"}, "containers": {"cna": {"title": "Tarkov Data Manager Authentication Bypass vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-843", "lang": "en", "description": "CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-r8w6-9xwg-6h73", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-r8w6-9xwg-6h73"}, {"name": "https://github.com/the-hideout/tarkov-data-manager/commit/f188f0abf766cefe3f1b7b4fc6fe9dad3736174a", "tags": ["x_refsource_MISC"], "url": "https://github.com/the-hideout/tarkov-data-manager/commit/f188f0abf766cefe3f1b7b4fc6fe9dad3736174a"}], "affected": [{"vendor": "the-hideout", "product": "tarkov-data-manager", "versions": [{"version": "<= 2.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T18:14:59.375Z"}, "descriptions": [{"lang": "en", "value": "The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows any unauthenticated user to gain full admin access to the Tarkov Data Manager admin panel by exploiting a JavaScript prototype property access vulnerability, combined with loose equality type coercion. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities."}], "source": {"advisory": "GHSA-r8w6-9xwg-6h73", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T18:40:33.171789Z", "id": "CVE-2026-21854", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T18:41:47.562Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21854", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-07T18:40:33.171789Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T18:40:53.606Z"}}], "cna": {"title": "Tarkov Data Manager Authentication Bypass vulnerability", "source": {"advisory": "GHSA-r8w6-9xwg-6h73", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "the-hideout", "product": "tarkov-data-manager", "versions": [{"status": "affected", "version": "<= 2.0.0"}]}], "references": [{"url": "https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-r8w6-9xwg-6h73", "name": "https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-r8w6-9xwg-6h73", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/the-hideout/tarkov-data-manager/commit/f188f0abf766cefe3f1b7b4fc6fe9dad3736174a", "name": "https://github.com/the-hideout/tarkov-data-manager/commit/f188f0abf766cefe3f1b7b4fc6fe9dad3736174a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows any unauthenticated user to gain full admin access to the Tarkov Data Manager admin panel by exploiting a JavaScript prototype property access vulnerability, combined with loose equality type coercion. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T18:14:59.375Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21854", "state": "PUBLISHED", "dateUpdated": "2026-01-07T18:41:47.562Z", "dateReserved": "2026-01-05T16:44:16.366Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-07T18:14:59.375Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "tarkov-data-manager", "vendor": "the-hideout", "versions": [{"status": "affected", "version": "<= 2.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tarkov:tarkov_data_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BED0E5B-BD43-4202-930F-9931EC05570C", "versionEndExcluding": "2025-01-02", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows any unauthenticated user to gain full admin access to the Tarkov Data Manager admin panel by exploiting a JavaScript prototype property access vulnerability, combined with loose equality type coercion. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities."}, {"lang": "es", "value": "El Tarkov Data Manager es una herramienta para gestionar los datos de los \u00edtems de Tarkov. Antes del 02 de enero de 2025, una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en el endpoint de inicio de sesi\u00f3n permite a cualquier usuario no autenticado obtener acceso de administrador completo al panel de administraci\u00f3n del Tarkov Data Manager explotando una vulnerabilidad de acceso a propiedades de prototipo de JavaScript, combinada con la coerci\u00f3n de tipo de igualdad flexible. Una serie de commits de correcci\u00f3n el 02 de enero de 2025 solucion\u00f3 esta y otras vulnerabilidades."}], "id": "CVE-2026-21854", "lastModified": "2026-06-17T10:19:02.067", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21854", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T18:40:33.171789Z", "version": "2.0.3"}}]}, "published": "2026-01-07T19:15:57.267", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/the-hideout/tarkov-data-manager/commit/f188f0abf766cefe3f1b7b4fc6fe9dad3736174a"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-r8w6-9xwg-6h73"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-843"}, {"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:50:19.214603+00:00", "value": {"mitigation_remediation": ["Apply the January\u202f2\u202f2025 patch commit that fixes the prototype property and type coercion flaw, ensuring the application runs a version newer than the one vulnerable.", "Restrict network access to the Tarkov Data Manager admin panel by implementing firewall rules or VPNs so only trusted administrators can reach the login endpoint.", "Conduct an audit of user accounts and verify that no unauthorized administrative privileges have been granted, and revoke any that should not exist."], "summary": {"action": "Apply Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "Vendors and products affected include the-hideout\u2019s Tarkov Data Manager. Versions prior to 02 January 2025 are impacted. No specific version string is listed, so any deployment of Tarkov Data Manager built before the release of the January 2, 2025 fix commits is considered vulnerable.", "description_and_impact": "The Tarkov Data Manager suffers an authentication bypass vulnerability that allows an unauthenticated user to gain full administrative access to its admin panel. The flaw arises from a JavaScript prototype property access issue combined with loose equality type coercion, which is an example of insecure deserialization and type confusion weaknesses (CWE\u20111321, CWE\u2011287, CWE\u2011843). The consequence is that an attacker can read, modify, or delete all item data managed by the application, potentially disrupting game balance and achieving unauthorized control over in\u2011game assets. The vulnerability directly impacts confidentiality, integrity, and availability of the managed data. The description states that any unauthenticated user can exploit this flaw via the login endpoint, implying that the exposure is through the web interface.", "risk_and_exploitability": "The flaw scores a nine point eight CVSS score, indicating a critical severity, yet its EPSS score is below one percent, suggesting that it is not among the most frequently exploited bugs. The vulnerability is not currently listed in CISA\u2019s KEV catalog. Attackers can exploit the flaw remotely by sending a crafted HTTP request to the login endpoint, exploiting the prototype pollution and type coercion to bypass authentication without needing valid credentials. No special privileges or environment configuration is required beyond remote network access to the web interface."}}}}, "created": "2026-04-18T17:00:05.565727+00:00", "updated": "2026-04-18T17:00:05.565737+00:00", "vendors": []}