CVE-2026-6571

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6571", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-18T19:07:03.225Z", "datePublished": "2026-04-19T12:00:17.810Z", "dateUpdated": "2026-04-20T14:18:17.474Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-19T12:00:17.810Z"}, "title": "kodcloud KodExplorer systemRole.class.php roleGroupAction authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "Authorization Bypass"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "kodcloud", "product": "KodExplorer", "versions": [{"version": "4.0", "status": "affected"}, {"version": "4.1", "status": "affected"}, {"version": "4.2", "status": "affected"}, {"version": "4.3", "status": "affected"}, {"version": "4.4", "status": "affected"}, {"version": "4.5", "status": "affected"}, {"version": "4.6", "status": "affected"}, {"version": "4.7", "status": "affected"}, {"version": "4.8", "status": "affected"}, {"version": "4.9", "status": "affected"}, {"version": "4.10", "status": "affected"}, {"version": "4.11", "status": "affected"}, {"version": "4.12", "status": "affected"}, {"version": "4.13", "status": "affected"}, {"version": "4.14", "status": "affected"}, {"version": "4.15", "status": "affected"}, {"version": "4.16", "status": "affected"}, {"version": "4.17", "status": "affected"}, {"version": "4.18", "status": "affected"}, {"version": "4.19", "status": "affected"}, {"version": "4.20", "status": "affected"}, {"version": "4.21", "status": "affected"}, {"version": "4.22", "status": "affected"}, {"version": "4.23", "status": "affected"}, {"version": "4.24", "status": "affected"}, {"version": "4.25", "status": "affected"}, {"version": "4.26", "status": "affected"}, {"version": "4.27", "status": "affected"}, {"version": "4.28", "status": "affected"}, {"version": "4.29", "status": "affected"}, {"version": "4.30", "status": "affected"}, {"version": "4.31", "status": "affected"}, {"version": "4.32", "status": "affected"}, {"version": "4.33", "status": "affected"}, {"version": "4.34", "status": "affected"}, {"version": "4.35", "status": "affected"}, {"version": "4.36", "status": "affected"}, {"version": "4.37", "status": "affected"}, {"version": "4.38", "status": "affected"}, {"version": "4.39", "status": "affected"}, {"version": "4.40", "status": "affected"}, {"version": "4.41", "status": "affected"}, {"version": "4.42", "status": "affected"}, {"version": "4.43", "status": "affected"}, {"version": "4.44", "status": "affected"}, {"version": "4.45", "status": "affected"}, {"version": "4.46", "status": "affected"}, {"version": "4.47", "status": "affected"}, {"version": "4.48", "status": "affected"}, {"version": "4.49", "status": "affected"}, {"version": "4.50", "status": "affected"}, {"version": "4.51", "status": "affected"}, {"version": "4.52", "status": "affected"}], "cpes": ["cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/systemRole.class.php. Executing a manipulation of the argument group_role can lead to authorization bypass. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-18T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-18T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-18T21:12:40.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "vulnplusbot (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/358205", "name": "VDB-358205 | kodcloud KodExplorer systemRole.class.php roleGroupAction authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358205/cti", "name": "VDB-358205 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/789987", "name": "Submit #789987 | KodExplorer 4.52 Authorization Bypass", "tags": ["third-party-advisory"]}, {"url": "https://vulnplus-note.wetolink.com/share/atu3UbqnfAgs", "tags": ["broken-link", "exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T14:18:02.072581Z", "id": "CVE-2026-6571", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:18:17.474Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "kodcloud KodExplorer systemRole.class.php roleGroupAction authorization", "credits": [{"lang": "en", "type": "reporter", "value": "vulnplusbot (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"], "vendor": "kodcloud", "product": "KodExplorer", "versions": [{"status": "affected", "version": "4.0"}, {"status": "affected", "version": "4.1"}, {"status": "affected", "version": "4.2"}, {"status": "affected", "version": "4.3"}, {"status": "affected", "version": "4.4"}, {"status": "affected", "version": "4.5"}, {"status": "affected", "version": "4.6"}, {"status": "affected", "version": "4.7"}, {"status": "affected", "version": "4.8"}, {"status": "affected", "version": "4.9"}, {"status": "affected", "version": "4.10"}, {"status": "affected", "version": "4.11"}, {"status": "affected", "version": "4.12"}, {"status": "affected", "version": "4.13"}, {"status": "affected", "version": "4.14"}, {"status": "affected", "version": "4.15"}, {"status": "affected", "version": "4.16"}, {"status": "affected", "version": "4.17"}, {"status": "affected", "version": "4.18"}, {"status": "affected", "version": "4.19"}, {"status": "affected", "version": "4.20"}, {"status": "affected", "version": "4.21"}, {"status": "affected", "version": "4.22"}, {"status": "affected", "version": "4.23"}, {"status": "affected", "version": "4.24"}, {"status": "affected", "version": "4.25"}, {"status": "affected", "version": "4.26"}, {"status": "affected", "version": "4.27"}, {"status": "affected", "version": "4.28"}, {"status": "affected", "version": "4.29"}, {"status": "affected", "version": "4.30"}, {"status": "affected", "version": "4.31"}, {"status": "affected", "version": "4.32"}, {"status": "affected", "version": "4.33"}, {"status": "affected", "version": "4.34"}, {"status": "affected", "version": "4.35"}, {"status": "affected", "version": "4.36"}, {"status": "affected", "version": "4.37"}, {"status": "affected", "version": "4.38"}, {"status": "affected", "version": "4.39"}, {"status": "affected", "version": "4.40"}, {"status": "affected", "version": "4.41"}, {"status": "affected", "version": "4.42"}, {"status": "affected", "version": "4.43"}, {"status": "affected", "version": "4.44"}, {"status": "affected", "version": "4.45"}, {"status": "affected", "version": "4.46"}, {"status": "affected", "version": "4.47"}, {"status": "affected", "version": "4.48"}, {"status": "affected", "version": "4.49"}, {"status": "affected", "version": "4.50"}, {"status": "affected", "version": "4.51"}, {"status": "affected", "version": "4.52"}]}], "timeline": [{"lang": "en", "time": "2026-04-18T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-18T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-18T21:12:40.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/358205", "name": "VDB-358205 | kodcloud KodExplorer systemRole.class.php roleGroupAction authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358205/cti", "name": "VDB-358205 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/789987", "name": "Submit #789987 | KodExplorer 4.52 Authorization Bypass", "tags": ["third-party-advisory"]}, {"url": "https://vulnplus-note.wetolink.com/share/atu3UbqnfAgs", "tags": ["broken-link", "exploit"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/systemRole.class.php. Executing a manipulation of the argument group_role can lead to authorization bypass. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-19T12:00:17.810Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6571", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T14:18:02.072581Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-20T14:18:13.511Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-6571", "state": "PUBLISHED", "dateUpdated": "2026-04-19T12:00:17.810Z", "dateReserved": "2026-04-18T19:07:03.225Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-19T12:00:17.810Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"], "product": "KodExplorer", "vendor": "kodcloud", "versions": [{"status": "affected", "version": "4.0"}, {"status": "affected", "version": "4.1"}, {"status": "affected", "version": "4.2"}, {"status": "affected", "version": "4.3"}, {"status": "affected", "version": "4.4"}, {"status": "affected", "version": "4.5"}, {"status": "affected", "version": "4.6"}, {"status": "affected", "version": "4.7"}, {"status": "affected", "version": "4.8"}, {"status": "affected", "version": "4.9"}, {"status": "affected", "version": "4.10"}, {"status": "affected", "version": "4.11"}, {"status": "affected", "version": "4.12"}, {"status": "affected", "version": "4.13"}, {"status": "affected", "version": "4.14"}, {"status": "affected", "version": "4.15"}, {"status": "affected", "version": "4.16"}, {"status": "affected", "version": "4.17"}, {"status": "affected", "version": "4.18"}, {"status": "affected", "version": "4.19"}, {"status": "affected", "version": "4.20"}, {"status": "affected", "version": "4.21"}, {"status": "affected", "version": "4.22"}, {"status": "affected", "version": "4.23"}, {"status": "affected", "version": "4.24"}, {"status": "affected", "version": "4.25"}, {"status": "affected", "version": "4.26"}, {"status": "affected", "version": "4.27"}, {"status": "affected", "version": "4.28"}, {"status": "affected", "version": "4.29"}, {"status": "affected", "version": "4.30"}, {"status": "affected", "version": "4.31"}, {"status": "affected", "version": "4.32"}, {"status": "affected", "version": "4.33"}, {"status": "affected", "version": "4.34"}, {"status": "affected", "version": "4.35"}, {"status": "affected", "version": "4.36"}, {"status": "affected", "version": "4.37"}, {"status": "affected", "version": "4.38"}, {"status": "affected", "version": "4.39"}, {"status": "affected", "version": "4.40"}, {"status": "affected", "version": "4.41"}, {"status": "affected", "version": "4.42"}, {"status": "affected", "version": "4.43"}, {"status": "affected", "version": "4.44"}, {"status": "affected", "version": "4.45"}, {"status": "affected", "version": "4.46"}, {"status": "affected", "version": "4.47"}, {"status": "affected", "version": "4.48"}, {"status": "affected", "version": "4.49"}, {"status": "affected", "version": "4.50"}, {"status": "affected", "version": "4.51"}, {"status": "affected", "version": "4.52"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/systemRole.class.php. Executing a manipulation of the argument group_role can lead to authorization bypass. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha identificado una debilidad en kodcloud KodExplorer hasta la versi\u00f3n 4.52. Afectada por esta vulnerabilidad es la funci\u00f3n roleGroupAction del archivo /app/controller/systemRole.class.php. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento group_role puede conducir a una omisi\u00f3n de autorizaci\u00f3n. El ataque puede ser lanzado remotamente. El exploit ha sido puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser utilizado para ataques. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-6571", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6571", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T14:18:02.072581Z", "version": "2.0.3"}}]}, "published": "2026-04-19T12:16:33.607", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/789987"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358205"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358205/cti"}, {"source": "cna@vuldb.com", "url": "https://vulnplus-note.wetolink.com/share/atu3UbqnfAgs"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-639"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.23"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.24"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.26"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.27"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.28"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.29"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.31"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.32"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.33"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.34"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.35"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.36"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.37"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.38"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.39"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.40"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.41"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.42"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.43"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.44"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.45"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.46"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.47"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.48"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.49"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.50"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.51"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.52"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "KodExplorer", "source": "cna", "vendor": "kodcloud"}, "product": "kodexplorer", "vendor": "kodcloud"}], "analysis": {"en": {"generated_at": "2026-04-19T13:21:20.961469+00:00", "value": {"mitigation_remediation": ["Verify the KodExplorer deployment version; versions 4.52 or earlier are potentially affected.", "Consult the vendor\u2019s website or security advisories for a patch or statement; if no fix exists, plan to upgrade to a supported version that eliminates the authorization flaw.", "Restrict the roleGroupAction endpoint by applying application\u2011level access control so that only trusted administrative users can modify group_role, or implement web\u2013application firewall rules to block or log requests containing unauthorized group_role parameters."], "summary": {"action": "Assess Impact", "impact": "Authorization Bypass (Privilege Escalation)"}, "threat_synthesis": {"affected_systems": "Kodcloud KodExplorer versions up to and including 4.52 are affected. No patch or fix has been released by the vendor at this time and the vulnerability is present in all mentioned versions.", "description_and_impact": "A weakness in the roleGroupAction function of kodcloud KodExplorer allows an attacker to manipulate the group_role argument to bypass normal authorization checks. This enables the attacker to execute actions that should only be available to privileged users or to modify group permissions remotely.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a medium impact. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack may be launched remotely by submitting a crafted request that includes a manipulated group_role parameter. The likely attack vector is via the web interface or an API that exposes the roleGroupAction endpoint, and the exploit has already been made publicly available."}}}}, "created": "2026-04-19T13:30:27.325515+00:00", "updated": "2026-04-19T16:15:25.492563+00:00", "vendors": ["kodcloud", "kodcloud$PRODUCT$kodexplorer"]}