CVE-2026-65709: sysPass Auth Bypass Vulnerability

CVE-2026-65709 Overview

CVE-2026-65709 is a missing object-level authorization vulnerability in sysPass through version 3.2.11. The flaw resides in the JSON-RPC API, where the AccountController methods do not enforce AccountFilterUser checks before acting on account records. API token holders can enumerate account metadata, overwrite stored passwords, and delete accounts across the entire vault regardless of their assigned token scope. The issue is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated API token holder can read, modify, or destroy every credential stored in the sysPass vault, breaking tenant isolation and enabling full compromise of managed secrets.

Affected Products

sysPass password manager through version 3.2.11
sysPass JSON-RPC API endpoint
Deployments exposing AccountController methods viewAction, editAction, deleteAction, and editPassAction

Discovery Timeline

2026-07-24 - CVE-2026-65709 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-65709

Vulnerability Analysis

sysPass is a self-hosted password manager that exposes a JSON-RPC API to allow automation and integration. Access is gated by API tokens that are supposed to be scoped to specific accounts or actions. The vulnerability arises because the API handler dispatches to AccountController methods without invoking the AccountFilterUser authorization layer that the web UI relies on. As a result, an attacker with any valid API token can operate on account IDs outside their permitted scope.

An attacker can call viewAction to enumerate account metadata, editAction to alter fields such as login or URL, editPassAction to overwrite stored credentials, and deleteAction to remove records entirely. This breaks the least-privilege model that scoped tokens are intended to provide and allows lateral compromise of every secret in the vault.

Root Cause

The root cause is missing per-object authorization on JSON-RPC endpoints. The API relies on token authentication but does not verify that the token subject has rights over the specific account_id referenced in the request. The AccountFilterUser predicate that constrains queries in other code paths is not applied here.

Attack Vector

Exploitation requires network access to the sysPass JSON-RPC endpoint and possession of any valid API token. The attacker submits crafted JSON-RPC requests referencing arbitrary account identifiers and invoking viewAction, editAction, editPassAction, or deleteAction. No user interaction is required, and the request complexity is low. See the GitHub Security Advisory and VulnCheck Advisory for full technical details.

No verified public exploit code is available at the time of publication, so no code sample is included here.

Detection Methods for CVE-2026-65709

Indicators of Compromise

JSON-RPC requests referencing account IDs outside the calling token's documented scope.
Unexpected calls to AccountController methods editAction, editPassAction, or deleteAction from automation tokens that historically issue only viewAction requests.
Bulk sequential enumeration of account_id values in API access logs.
Sudden deletion or password rotation events without a corresponding administrator login in the sysPass web UI audit log.

Detection Strategies

Correlate sysPass API access logs with token-to-account mappings and alert on any request that touches an out-of-scope account.
Baseline each API token's normal method usage and account footprint, then flag deviations such as first-time use of deleteAction or editPassAction.
Ingest sysPass audit logs into a SIEM and build rules for high-volume viewAction enumeration or unauthorized modification events.

Monitoring Recommendations

Enable verbose JSON-RPC request logging on the sysPass application and forward logs to a central log platform.
Monitor for outbound API traffic from hosts that should not be issuing sysPass RPC calls.
Track counts of accounts modified per token per hour and alert on statistical anomalies.

How to Mitigate CVE-2026-65709

Immediate Actions Required

Restrict network access to the sysPass JSON-RPC endpoint to trusted management hosts only.
Revoke and reissue all existing API tokens, granting only the minimum scope required.
Audit the sysPass account history for unexpected edit, editPass, or delete events since the API was first exposed.
Rotate any credentials stored in sysPass that may have been exposed to untrusted API token holders.

Patch Information

No fixed version is identified in the referenced advisories at the time of publication. Administrators should track the GitHub Security Advisory and upstream sysPass project releases for a patched build superseding 3.2.11.

Workarounds

Disable the JSON-RPC API entirely if it is not required by production automation.
Place the sysPass instance behind a reverse proxy or VPN that requires additional authentication before the JSON-RPC path is reachable.
Limit sysPass API tokens to read-only operations at the reverse-proxy layer by blocking JSON-RPC methods editAction, editPassAction, and deleteAction.
Segment the sysPass server into a dedicated network zone with strict egress and ingress controls.

bash

# Example nginx rule to block sensitive JSON-RPC methods at the proxy layer
location /api.php {
    if ($request_body ~* "\"method\"\s*:\s*\"account/(edit|editPass|delete)\"") {
        return 403;
    }
    proxy_pass http://syspass_backend;
}