CVE-2026-3739

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3739", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-07T20:07:31.011Z", "datePublished": "2026-03-08T14:02:09.949Z", "dateUpdated": "2026-03-12T15:00:17.476Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-08T14:02:09.949Z"}, "title": "suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication"}]}], "affected": [{"vendor": "suitenumerique", "product": "messages", "versions": [{"version": "0.2.0", "status": "affected"}, {"version": "0.3.0", "status": "unaffected"}], "modules": ["ThreadAccess"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in suitenumerique messages 0.2.0. This issue affects the function ThreadAccessSerializer of the file src/backend/core/api/serializers.py of the component ThreadAccess. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.3.0 is capable of addressing this issue. The patch is identified as d7729f4b885449f6dee3faf8b5f2a05769fb3d6e. The affected component should be upgraded."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-03-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-07T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-07T21:12:35.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "djnn (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.349717", "name": "VDB-349717 | suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.349717", "name": "VDB-349717 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.767329", "name": "Submit #767329 | La Suite Numerique messages 0.2.0 IDOR", "tags": ["third-party-advisory"]}, {"url": "https://github.com/suitenumerique/messages/security/advisories/GHSA-7476-6crq-4cw9", "tags": ["exploit"]}, {"url": "https://github.com/suitenumerique/messages/pull/557", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/suitenumerique/messages/commit/d7729f4b885449f6dee3faf8b5f2a05769fb3d6e", "tags": ["patch"]}, {"url": "https://github.com/suitenumerique/messages/releases/tag/v0.3.0", "tags": ["patch"]}, {"url": "https://github.com/suitenumerique/messages/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T15:00:06.149306Z", "id": "CVE-2026-3739", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T15:00:17.476Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3739", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T15:00:06.149306Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T15:00:10.792Z"}}], "cna": {"tags": ["x_open-source"], "title": "suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication", "credits": [{"lang": "en", "type": "reporter", "value": "djnn (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "suitenumerique", "modules": ["ThreadAccess"], "product": "messages", "versions": [{"status": "affected", "version": "0.2.0"}, {"status": "unaffected", "version": "0.3.0"}]}], "timeline": [{"lang": "en", "time": "2026-03-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-07T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-07T21:12:35.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.349717", "name": "VDB-349717 | suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.349717", "name": "VDB-349717 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.767329", "name": "Submit #767329 | La Suite Numerique messages 0.2.0 IDOR", "tags": ["third-party-advisory"]}, {"url": "https://github.com/suitenumerique/messages/security/advisories/GHSA-7476-6crq-4cw9", "tags": ["exploit"]}, {"url": "https://github.com/suitenumerique/messages/pull/557", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/suitenumerique/messages/commit/d7729f4b885449f6dee3faf8b5f2a05769fb3d6e", "tags": ["patch"]}, {"url": "https://github.com/suitenumerique/messages/releases/tag/v0.3.0", "tags": ["patch"]}, {"url": "https://github.com/suitenumerique/messages/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in suitenumerique messages 0.2.0. This issue affects the function ThreadAccessSerializer of the file src/backend/core/api/serializers.py of the component ThreadAccess. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.3.0 is capable of addressing this issue. The patch is identified as d7729f4b885449f6dee3faf8b5f2a05769fb3d6e. The affected component should be upgraded."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-08T14:02:09.949Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3739", "state": "PUBLISHED", "dateUpdated": "2026-03-12T15:00:17.476Z", "dateReserved": "2026-03-07T20:07:31.011Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-08T14:02:09.949Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["ThreadAccess"], "product": "messages", "vendor": "suitenumerique", "versions": [{"status": "affected", "version": "0.2.0"}, {"status": "unaffected", "version": "0.3.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in suitenumerique messages 0.2.0. This issue affects the function ThreadAccessSerializer of the file src/backend/core/api/serializers.py of the component ThreadAccess. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.3.0 is capable of addressing this issue. The patch is identified as d7729f4b885449f6dee3faf8b5f2a05769fb3d6e. The affected component should be upgraded."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en suitenumerique messages 0.2.0. Este problema afecta la funci\u00f3n ThreadAccessSerializer del archivo src/backend/core/API/serializers.py del componente ThreadAccess. La manipulaci\u00f3n resulta en autenticaci\u00f3n impropia. El ataque puede ser ejecutado remotamente. El exploit ha sido liberado al p\u00fablico y puede ser usado para ataques. La actualizaci\u00f3n a la versi\u00f3n 0.3.0 es capaz de abordar este problema. El parche es identificado como d7729f4b885449f6dee3faf8b5f2a05769fb3d6e. El componente afectado deber\u00eda ser actualizado."}], "id": "CVE-2026-3739", "lastModified": "2026-06-17T10:44:06.920", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3739", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T15:00:06.149306Z", "version": "2.0.3"}}]}, "published": "2026-03-08T14:15:54.963", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/suitenumerique/messages/"}, {"source": "cna@vuldb.com", "url": "https://github.com/suitenumerique/messages/commit/d7729f4b885449f6dee3faf8b5f2a05769fb3d6e"}, {"source": "cna@vuldb.com", "url": "https://github.com/suitenumerique/messages/pull/557"}, {"source": "cna@vuldb.com", "url": "https://github.com/suitenumerique/messages/releases/tag/v0.3.0"}, {"source": "cna@vuldb.com", "url": "https://github.com/suitenumerique/messages/security/advisories/GHSA-7476-6crq-4cw9"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.349717"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.349717"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.767329"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.3.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "messages", "source": "cna", "vendor": "suitenumerique"}, "product": "messages", "vendor": "suitenumerique"}], "analysis": {"en": {"generated_at": "2026-04-16T10:33:59.419680+00:00", "value": {"mitigation_remediation": ["Upgrade suitenumerique messages to version 0.3.0 or later, which contains the fixed commit d7729f4b885449f6dee3faf8b5f2a05769fb3d6e.", "Ensure that any custom code around ThreadAccessSerializer performs proper authentication checks before granting access to protected resources.", "If an upgrade cannot be performed immediately, restrict network access to the ThreadAccess API endpoint to trusted IP ranges or enforce additional authentication layers (e.g., API keys).", "Monitor application logs for unexpected authentication patterns or repeated failed attempts to indicate exploitation attempts."], "summary": {"action": "Patch Now", "impact": "Improper Authentication (CWE-287) can lead to unauthorized access to the suitenumerique messages application"}, "threat_synthesis": {"affected_systems": "The issue affects the suitenumerique messages package, specifically version 0.2.0. The official recommendation is to upgrade to version 0.3.0, which incorporates the fix. The affected component is the ThreadAccess API, located in the src/backend/core/api/serializers.py file.", "description_and_impact": "The vulnerability resides in the ThreadAccessSerializer class of suitenumerique messages. An attacker can manipulate requests so that authentication checks are bypassed, allowing them to assume any user identity. The results in a classic authentication bypass (CWE-287) and is capable of being exploited remotely through the exposed API endpoint. It can enable an attacker to gain unauthorized access to sensitive information and perform privileged actions without proper credentials.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild at this time. The vulnerability is not listed in CISA's KEV catalog, and a public exploit has been released, enabling attackers to target this flaw. The attack vector is remote, relying on sending crafted requests to the ThreadAccessSerializer endpoint. If the system is not patched, an attacker could obtain unauthorized access to user data and potentially elevate privileges within the application."}}}}, "created": "2026-03-09T10:03:10.077910+00:00", "updated": "2026-04-16T10:45:26.008118+00:00", "vendors": ["suitenumerique", "suitenumerique$PRODUCT$messages"]}