CVE-2026-65708: sysPass Auth Bypass Vulnerability

CVE-2026-65708 Overview

CVE-2026-65708 is an Insecure Direct Object Reference (IDOR) vulnerability affecting sysPass through version 3.2.11. The flaw resides in the AccountFileController, which fails to enforce account-level Access Control List (ACL) checks before operating on file attachments. Any authenticated user can supply arbitrary numeric file identifiers to download, view, delete, upload, and list actions to access attachments belonging to accounts they do not own. The issue is categorized under CWE-639: Authorization Bypass Through User-Controlled Key and allows attackers to enumerate the entire attachment vault.

Critical Impact
Any authenticated sysPass user can read, modify, and delete arbitrary account file attachments, bypassing the ACL model that protects credential-related documents.

Affected Products

sysPass password manager through version 3.2.11
AccountFileController component handling attachment download, view, delete, upload, and list actions
Deployments exposing sysPass to any authenticated user population

Discovery Timeline

2026-07-24 - CVE-2026-65708 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-65708

Vulnerability Analysis

sysPass is a self-hosted PHP password manager that stores account records and permits users to attach files such as certificates, keys, or documentation to those records. Access to each account is governed by an ACL that binds users and groups to specific account IDs. The attachment subsystem, however, does not consult that ACL. When the AccountFileController receives a request referencing a file ID, it operates on the requested attachment without verifying whether the calling session has permission to view the parent account.

Because file IDs are sequential integers, an authenticated attacker can iterate through the identifier space and enumerate every attachment stored in the vault. The same defect exposes destructive actions: an attacker can delete attachments belonging to other accounts and upload files under identifiers they should not control.

Root Cause

The root cause is a missing authorization check in AccountFileController between request parsing and attachment access. The controller trusts the user-supplied fileId parameter and resolves it directly against the storage layer. There is no mediating check confirming that the current session holds a valid ACL grant on the account that owns the referenced file, which is the definition of an IDOR under CWE-639.

Attack Vector

Exploitation requires network access to the sysPass web interface and low-privilege authenticated credentials, with no user interaction beyond the attacker's own session. The attacker issues HTTP requests to the download, view, delete, upload, and list endpoints in AccountFileController while substituting arbitrary numeric file IDs. Because ACL evaluation is skipped, the server returns or mutates the target attachment regardless of ownership, enabling mass extraction of secrets stored as file attachments. Refer to the VulnCheck Security Advisory and the GitHub CVE-2026-65708 Advisory for endpoint-level detail.

Detection Methods for CVE-2026-65708

Indicators of Compromise

Sequential HTTP requests from a single authenticated session iterating fileId values against sysPass attachment endpoints.
Unexpected AccountFile download, view, delete, or upload actions logged for users who do not hold ACL rights on the parent account.
Spikes in attachment access volume from a single user account within a short window.

Detection Strategies

Parse sysPass application logs for AccountFileController invocations and correlate the acting user against the account owner and ACL membership; alert on mismatches.
Inspect web server access logs for request patterns that walk fileId parameters in monotonic order.
Baseline per-user attachment access rates and flag deviations that exceed normal operator behavior.

Monitoring Recommendations

Forward sysPass and reverse-proxy logs to a centralized analytics platform and retain them for post-incident review.
Enable audit logging for all attachment lifecycle events, including download, view, delete, and upload.
Alert on any deletion or overwrite of attachments performed by users who are not the account owner or an ACL-approved editor.

How to Mitigate CVE-2026-65708

Immediate Actions Required

Restrict network exposure of sysPass to trusted administrators and remove any unauthenticated or broad-access reachability until a fix is applied.
Audit existing sysPass user accounts and revoke sessions or credentials that are no longer required.
Review attachment audit logs for evidence of enumeration or unauthorized access, and rotate any secrets stored as attachments if compromise is suspected.

Patch Information

At the time of publication, no fixed release is identified in the NVD entry for sysPass beyond version 3.2.11. Track the GitHub CVE-2026-65708 Advisory and the upstream sysPass project for a patched build, and apply it as soon as it becomes available.

Workarounds

Place sysPass behind a reverse proxy or VPN that limits access to a small set of trusted operators.
Stop using account file attachments for sensitive material until the authorization check is restored; store secrets in the account fields that remain governed by the ACL.
If source-level modification is feasible, add an explicit ACL check in AccountFileController that resolves the fileId to its parent account and verifies the current session's permission before executing any action.

bash

# Example nginx allow-list to restrict sysPass access to trusted networks
location /syspass/ {
    allow 10.0.0.0/24;    # admin subnet
    allow 192.168.50.10;  # jump host
    deny  all;
    proxy_pass http://syspass_backend;
}