CVE-2026-5251

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5251", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-31T16:11:37.477Z", "datePublished": "2026-04-01T02:30:14.392Z", "dateUpdated": "2026-04-01T13:12:46.568Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-01T02:30:14.392Z"}, "title": "z-9527 admin User Update Endpoint user.js dynamically-determined object attributes", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-915", "lang": "en", "description": "Dynamically-Determined Object Attributes"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-913", "lang": "en", "description": "Dynamically-Managed Code Resources"}]}], "affected": [{"vendor": "z-9527", "product": "admin", "versions": [{"version": "1.0", "status": "affected"}, {"version": "2.0", "status": "affected"}], "modules": ["User Update Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-31T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-31T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-31T18:16:45.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/354441", "name": "VDB-354441 | z-9527 admin User Update Endpoint user.js dynamically-determined object attributes", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354441/cti", "name": "VDB-354441 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780607", "name": "Submit #780607 | z-9527 admin \u2264 commit 72aaf2d Dynamically-Determined Object Attributes", "tags": ["third-party-advisory"]}, {"url": "https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-11", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T13:12:39.257313Z", "id": "CVE-2026-5251", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:12:46.568Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5251", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T13:12:39.257313Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:12:43.185Z"}}], "cna": {"title": "z-9527 admin User Update Endpoint user.js dynamically-determined object attributes", "credits": [{"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "z-9527", "modules": ["User Update Endpoint"], "product": "admin", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "2.0"}]}], "timeline": [{"lang": "en", "time": "2026-03-31T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-31T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-31T18:16:45.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/354441", "name": "VDB-354441 | z-9527 admin User Update Endpoint user.js dynamically-determined object attributes", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354441/cti", "name": "VDB-354441 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780607", "name": "Submit #780607 | z-9527 admin \u2264 commit 72aaf2d Dynamically-Determined Object Attributes", "tags": ["third-party-advisory"]}, {"url": "https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-11", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-915", "description": "Dynamically-Determined Object Attributes"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-913", "description": "Dynamically-Managed Code Resources"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-01T02:30:14.392Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5251", "state": "PUBLISHED", "dateUpdated": "2026-04-01T13:12:46.568Z", "dateReserved": "2026-03-31T16:11:37.477Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-01T02:30:14.392Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["User Update Endpoint"], "product": "admin", "vendor": "z-9527", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "2.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en z-9527 admin 1.0/2.0. Esto afecta una funci\u00f3n desconocida del archivo /servidor/routes/user.js del componente User Update Endpoint. Dicha manipulaci\u00f3n del argumento isAdmin con la entrada 1 conduce a atributos de objeto determinados din\u00e1micamente. Es posible lanzar el ataque remotamente. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-5251", "lastModified": "2026-06-17T10:58:40.930", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5251", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T13:12:39.257313Z", "version": "2.0.3"}}]}, "published": "2026-04-01T03:15:59.050", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-11"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/780607"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354441"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354441/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-913"}, {"lang": "en", "value": "CWE-915"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "admin", "source": "cna", "vendor": "z-9527"}, "product": "admin", "vendor": "z-9527"}], "analysis": {"en": {"generated_at": "2026-04-01T05:54:07.507930+00:00", "value": {"mitigation_remediation": ["Verify whether a newer version of z\u20119527 admin is available and apply the patch immediately.", "If no patch exists, restrict external access to the User Update Endpoint using firewall rules or VPN so only trusted networks can reach it.", "Implement server\u2011side validation to sanitize the isAdmin parameter before it is used in object property creation.", "Monitor application logs for unexpected changes to user objects or elevation of privileges.", "If the vendor remains unresponsive, consider disabling the update endpoint or migrating to a more secure user management solution."], "summary": {"action": "Assess Impact", "impact": "Unauthorized Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability is known to affect z\u20119527 admin versions 1.0 and 2.0 through the /server/routes/user.js endpoint. Systems running these specific versions should evaluate whether the endpoint is exposed to untrusted traffic and assess their exposure to the described issue.", "description_and_impact": "A flaw in the User Update Endpoint of z\u20119527 admin allows an attacker to send the isAdmin parameter with the value 1, causing the server to create object properties whose names are resolved at runtime. This dynamic property creation bypasses normal input validation and permits an attacker to alter essential user attributes, potentially granting elevated privileges or modifying user data without authorization.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, and no exploit prevalence score is provided. Exploitation can occur remotely via the HTTP interface to the user update endpoint, and publicly available proof\u2011of\u2011concept code exists. While the vulnerability is not catalogued in the CISA Known Exploited Vulnerabilities list, the remote nature and lack of restrictions make it a potential risk for privilege escalation if it remains unpatched."}}}}, "created": "2026-04-02T07:50:19.410240+00:00", "updated": "2026-04-02T20:18:31.567915+00:00", "vendors": ["z-9527", "z-9527$PRODUCT$admin"]}