CVE-2026-18720: KodBox msgWarning Auth Bypass Vulnerability

CVE-2026-18720 Overview

CVE-2026-18720 is an improper authorization vulnerability [CWE-266] affecting kalcaddle kodbox version 1.67 Build 02. The flaw resides in the msgWarning plugin, specifically in code reachable through /index.php?plugin/msgWarning/action. Attackers can exploit the weakness remotely without authentication or user interaction. A public exploit exists, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote attackers can invoke restricted plugin actions in kodbox 1.67 Build 02 without proper authorization checks, allowing unauthorized access to functionality intended for privileged users.

Affected Products

kalcaddle kodbox 1.67 Build 02
Component: msgWarning plugin
Endpoint: /index.php?plugin/msgWarning/action

Discovery Timeline

2026-08-04 - CVE-2026-18720 published to the National Vulnerability Database (NVD)
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18720

Vulnerability Analysis

kodbox is a web-based file management platform built in PHP. The msgWarning plugin exposes an action handler reachable through the /index.php?plugin/msgWarning/action route. The handler fails to enforce proper permission checks before executing its logic.

An unauthenticated remote attacker can send a crafted HTTP request to this endpoint and invoke the plugin action. Because authorization is missing rather than merely misconfigured, the request is processed as though the caller held the required role. The confidentiality impact under CVSS 4.0 is limited to low, indicating exposure of restricted plugin functionality rather than full system takeover.

A proof of concept has been published via the referenced GitHub issue, and the vendor did not acknowledge the disclosure. See the GitHub Issue Discussion and VulDB CVE-2026-18720 for reference material.

Root Cause

The root cause is a missing or incorrect authorization check inside the msgWarning plugin's action handler. CWE-266 (Incorrect Privilege Assignment) reflects that the code path grants a privilege level higher than intended for anonymous or lower-privileged callers.

Attack Vector

Exploitation requires only network access to the kodbox web interface. The attacker issues an HTTP request to /index.php?plugin/msgWarning/action with the parameters expected by the plugin. No credentials, tokens, or user interaction are required. Refer to the published proof of concept for technical details on the request structure.

Detection Methods for CVE-2026-18720

Indicators of Compromise

HTTP requests to /index.php?plugin/msgWarning/action from unauthenticated sessions or unexpected source addresses
Web server access logs showing repeated invocations of the msgWarning plugin endpoint outside of normal administrative activity
Successful HTTP 200 responses to the plugin action without a preceding authenticated session cookie

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to /index.php with the plugin/msgWarning/action query pattern and validate session context
Correlate access logs against authenticated session state to flag anonymous invocations of privileged plugin routes
Alert on any request to the msgWarning plugin that originates from IP ranges outside the administrative allow-list

Monitoring Recommendations

Enable verbose HTTP request logging on kodbox instances, including query strings and referrer headers
Forward web server and application logs to a centralized SIEM for correlation with authentication events
Baseline normal plugin usage patterns and alert on statistical deviations in msgWarning invocation frequency

How to Mitigate CVE-2026-18720

Immediate Actions Required

Restrict access to the kodbox administrative interface using network controls, VPN, or IP allow-listing
Block external requests matching /index.php?plugin/msgWarning/action at the reverse proxy or WAF until a patch is available
Audit web server logs for prior exploitation attempts against the affected endpoint

Patch Information

No vendor patch is available. The kalcaddle project did not respond to the disclosure. Operators should track the upstream kodbox repository for a fixed release and monitor VulDB Vulnerability #385631 for updates.

Workarounds

Disable the msgWarning plugin in the kodbox administrative console if the functionality is not required
Place the kodbox instance behind an authenticated reverse proxy that enforces its own access controls
Apply reverse-proxy rewrite rules that reject unauthenticated requests to plugin action endpoints

bash

# Example nginx snippet: block unauthenticated access to the msgWarning plugin
location ~ ^/index\.php {
    if ($arg_plugin ~* "msgWarning/action") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}