CVE-2026-27181

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27181", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-18T15:22:30.054Z", "datePublished": "2026-02-18T21:10:41.878Z", "dateUpdated": "2026-11-08T14:01:43.749Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:01:43.749Z"}, "datePublic": "2026-02-17T00:00:00.000Z", "title": "MajorDoMo Unauthenticated Module Uninstall via Market Endpoint", "descriptions": [{"lang": "en", "value": "MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of execution, making all mode-gated code paths reachable without authentication via the /objects/?module=market endpoint. The uninstall mode handler calls uninstallPlugin(), which deletes module records from the database, executes the module's uninstall() method via eval(), recursively deletes the module's directory and template files using removeTree(), and removes associated cycle scripts. An attacker can iterate through module names and wipe the entire MajorDoMo installation with a series of unauthenticated GET requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "affected": [{"vendor": "sergejey", "product": "MajorDoMo", "versions": [{"version": "0", "lessThanOrEqual": "*", "status": "affected", "versionType": "custom"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sergejey:majordomo:*:*:*:*:*:*:*:*"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://chocapikk.com/posts/2026/majordomo-revisited/", "name": "MajorDoMo Revisited: What I Missed in 2023", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sergejey/majordomo/pull/1177", "name": "Fix PR: sergejey/majordomo#1177", "tags": ["issue-tracking", "patch"]}, {"name": "VulnCheck Advisory: MajorDoMo Unauthenticated Module Uninstall via Market Endpoint", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/majordomo-unauthenticated-module-uninstall-via-market-endpoint"}], "credits": [{"lang": "en", "value": "Valentin Lobstein", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T21:25:23.683703Z", "id": "CVE-2026-27181", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T21:27:03.900Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27181", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T21:25:23.683703Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T21:25:29.876Z"}}], "cna": {"title": "MajorDoMo Unauthenticated Module Uninstall via Market Endpoint", "credits": [{"lang": "en", "type": "finder", "value": "Valentin Lobstein"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "sergejey", "product": "MajorDoMo", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "datePublic": "2026-02-17T00:00:00.000Z", "references": [{"url": "https://chocapikk.com/posts/2026/majordomo-revisited/", "name": "MajorDoMo Revisited: What I Missed in 2023", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sergejey/majordomo/pull/1177", "name": "Fix PR: sergejey/majordomo#1177", "tags": ["issue-tracking", "patch"]}, {"url": "https://www.vulncheck.com/advisories/majordomo-unauthenticated-module-uninstall-via-market-endpoint", "name": "VulnCheck Advisory: MajorDoMo Unauthenticated Module Uninstall via Market Endpoint", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of execution, making all mode-gated code paths reachable without authentication via the /objects/?module=market endpoint. The uninstall mode handler calls uninstallPlugin(), which deletes module records from the database, executes the module's uninstall() method via eval(), recursively deletes the module's directory and template files using removeTree(), and removes associated cycle scripts. An attacker can iterate through module names and wipe the entire MajorDoMo installation with a series of unauthenticated GET requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sergejey:majordomo:*:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:01:43.749Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27181", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:01:43.749Z", "dateReserved": "2026-02-18T15:22:30.054Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-18T21:10:41.878Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "MajorDoMo", "vendor": "sergejey", "versions": [{"lessThanOrEqual": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mjdm:majordomo:-:*:*:*:*:*:*:*", "matchCriteriaId": "7008978E-8DE1-4811-958F-3AFB3847B919", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of execution, making all mode-gated code paths reachable without authentication via the /objects/?module=market endpoint. The uninstall mode handler calls uninstallPlugin(), which deletes module records from the database, executes the module's uninstall() method via eval(), recursively deletes the module's directory and template files using removeTree(), and removes associated cycle scripts. An attacker can iterate through module names and wipe the entire MajorDoMo installation with a series of unauthenticated GET requests."}, {"lang": "es", "value": "MajorDoMo (tambi\u00e9n conocido como Major Domestic Module) permite la desinstalaci\u00f3n arbitraria de m\u00f3dulos no autenticada a trav\u00e9s del m\u00f3dulo de mercado. El m\u00e9todo admin() del m\u00f3dulo de mercado lee gr('mode') de $_REQUEST y lo asigna a $this->mode al inicio de la ejecuci\u00f3n, haciendo que todas las rutas de c\u00f3digo protegidas por modo sean accesibles sin autenticaci\u00f3n a trav\u00e9s del endpoint /objects/?module=market. El gestor del modo de desinstalaci\u00f3n llama a uninstallPlugin(), que elimina registros de m\u00f3dulos de la base de datos, ejecuta el m\u00e9todo uninstall() del m\u00f3dulo a trav\u00e9s de eval(), elimina recursivamente el directorio del m\u00f3dulo y los archivos de plantilla usando removeTree(), y elimina los scripts de ciclo asociados. Un atacante puede iterar a trav\u00e9s de nombres de m\u00f3dulos y borrar toda la instalaci\u00f3n de MajorDoMo con una serie de solicitudes GET no autenticadas."}], "id": "CVE-2026-27181", "lastModified": "2026-06-17T10:26:48.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27181", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T21:25:23.683703Z", "version": "2.0.3"}}]}, "published": "2026-02-18T22:16:26.337", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://chocapikk.com/posts/2026/majordomo-revisited/"}, {"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/sergejey/majordomo/pull/1177"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/majordomo-unauthenticated-module-uninstall-via-market-endpoint"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MajorDoMo", "source": "cna", "vendor": "sergejey"}, "product": "majordomo", "vendor": "sergejey"}], "analysis": {"en": {"generated_at": "2026-04-16T17:04:16.564046+00:00", "value": {"mitigation_remediation": ["Apply the patch supplied in the GitHub pull request (sergejey/majordomo#1177) to fix the market module\u2019s authorization bypass.", "Restrict access to the /objects/?module=market endpoint so that only authenticated users can reach it\u2014use .htaccess, firewall rules, or platform authentication middleware.", "Disable or remove the market module from the system if it is not required, thereby eliminating the vulnerable endpoint until the patch can be applied."], "summary": {"action": "Apply Vendor Patch", "impact": "Unauthenticated deletion of modules, allowing full removal of application functionality"}, "threat_synthesis": {"affected_systems": "MajorDoMo (sergejey:MajorDoMo) \u2013 all versions are affected; no version constraints are specified.", "description_and_impact": "MajorDoMo\u2019s market module contains an admin() method that reads a 'mode' parameter from the request and assigns it to a class property without any authentication checks. When this endpoint is accessed via /objects/?module=market, the code path that handles the 'uninstall' mode becomes reachable. The handler calls uninstallPlugin(), which removes database entries for the target module, evaluates the module\u2019s uninstall() method with eval(), recursively deletes the module\u2019s directory and template files, and removes associated cycle scripts. By iterating over existing module names with unauthenticated GET requests, an attacker can delete individual modules or effectively wipe the entire MajorDoMo installation. This missing authorization flaw (CWE\u2011862) enables arbitrary deletion of application components, resulting in loss of functionality and potential denial of service.", "risk_and_exploitability": "The CVSS score of 8.7 reflects the high impact of this flaw. The EPSS score is below 1\u202f%, indicating a low probability of exploitation at the moment, and the vulnerability is not yet listed in the CISA KEV catalog. Nonetheless, the attack vector is straightforward: an unauthenticated attacker sends HTTP GET requests to the /objects/?module=market endpoint, and does not require any other privileges or elevated access. If exploited, the attacker can permanently delete modules or the complete system, making this a significant availability and integrity threat for unattended installations."}}}}, "created": "2026-02-19T10:10:58.367770+00:00", "updated": "2026-04-16T17:15:17.976558+00:00", "vendors": ["sergejey", "sergejey$PRODUCT$majordomo"]}