GHSA-v554-w28r-wj53CriticalCVSS 9.8
sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows...
🔗 CVE IDs covered (1)
📋 Description
sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite config.xml, point the application at an attacker-controlled database, create an administrator account, and plant serialized PublicLink gadget chains triggered via account/viewLink to execute commands.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-129110
- https://github.com/nuxsmin/sysPass/issues/1954
- https://github.com/OpusProjects/sysPass/pull/360
- https://github.com/nuxsmin/sysPass
- https://github.com/nuxsmin/sysPass/blob/3.2.11/app/modules/web/Controllers/InstallController.php#L80-L110
- https://www.vulncheck.com/advisories/syspass-3.0.1-through-3.2.11-unauthenticated-reinstallation-rce-via-install-install
- https://github.com/advisories/GHSA-v554-w28r-wj53