{"identifier":"CVE-2026-117472","cve":{"id":"CVE-2026-117472","description":"Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.","published":"2026-10-27T06:17:25.153000+00:00","modified":"2026-10-27T15:00:49.240000+00:00","status":"Deferred","score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_version":"3.1","affected":[],"weaknesses":["CWE-863"],"references":[{"url":"https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117472.md","source":"fdf66990-8419-4c8c-8848-ec15d75773b4"},{"url":"https://gitlab.com/esaqa/psono/psono-server","source":"fdf66990-8419-4c8c-8848-ec15d75773b4"},{"url":"https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/permissions.py","source":"fdf66990-8419-4c8c-8848-ec15d75773b4"},{"url":"https://gitlab.com/esaqa/psono/psono-server/-/commit/5638d4be806af7d1dea03f7cad3927aa2bd19cf4","source":"fdf66990-8419-4c8c-8848-ec15d75773b4"},{"url":"https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4","source":"fdf66990-8419-4c8c-8848-ec15d75773b4"}],"kev":null,"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"configurations":[],"source":"nvd","retrieved_at":"2026-10-28T10:27:42.383980+00:00","exploited":false,"kev_stale":false,"products":[],"priority":{"label":"Assess exposure and vendor guidance","reasons":["No higher-priority signal is available in the current stored evidence."]},"epss":{"probability":0.00323,"percentile":0.25284,"date":"2026-10-29","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"gitlab.com","source_url":"https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117472.md","investigate_url":"https://investigate.aeglixmind.com/#gitlab.com"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2026-117472","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2026-117472","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2026-117472","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}