CVE-2026-108810: tsi-dpdp-cms Information Disclosure Flaw

CVE-2026-108810 Overview

CVE-2026-108810 is an information disclosure vulnerability affecting tsi-coop tsi-dpdp-cms versions 0.5.0, 0.5.1, and 0.5.2. The flaw resides in the JSON Schema Validation component, where manipulation of the _func argument exposes API parameter schema data without requiring authentication. Attackers can reach the vulnerable endpoint remotely over the network. A public exploit has been released, increasing the likelihood of opportunistic probing against exposed instances. The maintainers responded to the report quickly and shipped version 0.5.3 as the fixed release. The weakness is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can enumerate API parameter schemas from the JSON Schema Validation component, exposing structural details useful for follow-on attacks.

Affected Products

tsi-coop tsi-dpdp-cms 0.5.0
tsi-coop tsi-dpdp-cms 0.5.1
tsi-coop tsi-dpdp-cms 0.5.2

Discovery Timeline

2026-10-12 - CVE CVE-2026-108810 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-108810

Vulnerability Analysis

The vulnerability lives in the JSON Schema Validation layer of tsi-dpdp-cms. The component accepts a _func argument that controls which schema-related operation is executed. When the argument is manipulated, the application returns schema information that should remain internal to the application. Because the endpoint does not enforce authentication, any remote client can issue the request and receive the response. The disclosed schema data describes API parameter shapes, types, and validation rules, which lowers the barrier to crafting targeted follow-on requests. Public documentation of the issue is available in the TSI DPDP CMS Security Fix Documentation and the reporter's write-up.

Root Cause

The root cause is missing access control around a schema introspection code path. The _func parameter is treated as a trusted selector and reaches schema-returning logic without first verifying the caller's identity or authorization. Confidentiality controls that should wrap internal schema metadata are absent, matching the CWE-200 classification.

Attack Vector

Exploitation is remote and network-based. An attacker sends a crafted HTTP request to the vulnerable endpoint with a manipulated _func value. No credentials, user interaction, or elevated privileges are required. The server responds with API parameter schema details that the attacker can parse to map the application surface. The EPSS score for this CVE is 0.322% at the 23.6 percentile as of 2026-10-16.

// No verified exploit code is published inline. See the public reporter
// write-up for request structure and parameter manipulation details:
// https://github.com/kavinkumarst/TSI-DPDP-CMS-API-Parameter-Schema-Enumerable-Without-Authentication

Detection Methods for CVE-2026-108810

Indicators of Compromise

Unauthenticated HTTP requests to tsi-dpdp-cms endpoints containing the _func query or body parameter.
Response payloads containing JSON Schema structures, field type definitions, or validation rules returned to unauthenticated clients.
Repeated schema-enumeration requests originating from a single source address or scanner user-agent.

Detection Strategies

Inspect application and reverse-proxy logs for requests referencing _func where the session has no authenticated user context.
Alert on outbound responses from tsi-dpdp-cms whose body contains schema keywords such as "$schema", "properties", or "required" when returned to anonymous clients.
Correlate schema-enumeration requests with subsequent anomalous API calls that use newly discovered parameter names.

Monitoring Recommendations

Enable verbose access logging on the tsi-dpdp-cms API tier and forward logs to a central analytics platform for retention and query.
Baseline normal API usage patterns and flag deviations in parameter cardinality or endpoint access by unauthenticated sources.
Track the installed tsi-dpdp-cms version across environments and alert when any host runs 0.5.0, 0.5.1, or 0.5.2.

How to Mitigate CVE-2026-108810

Immediate Actions Required

Upgrade all tsi-dpdp-cms instances to version 0.5.3 or later as published in the v0.5.3 release.
Inventory internet-exposed deployments and prioritize patching those reachable from untrusted networks.
Review access logs for prior exploitation attempts referencing the _func parameter and preserve evidence for triage.

Patch Information

The vendor released tsi-dpdp-cms version 0.5.3 to remediate the issue. Technical details of the fix are documented in the security-fixes/4.md advisory. Additional context is available at VulDB CVE-2026-108810.

Workarounds

Place the application behind an authenticating reverse proxy or API gateway that rejects anonymous requests to schema-related endpoints.
Add a web application firewall rule that blocks requests containing the _func parameter from unauthenticated sources until the upgrade is applied.
Restrict network exposure of the tsi-dpdp-cms management and API endpoints to trusted internal ranges.

bash

# Example WAF rule concept - block unauthenticated _func requests
# Adapt syntax to your WAF or reverse proxy platform
if ($arg__func != "" && $http_authorization = "") {
    return 403;
}