CVE-2026-65710: sysPass Auth Bypass Vulnerability

CVE-2026-65710 Overview

CVE-2026-65710 is a missing authorization vulnerability [CWE-639] in sysPass through version 3.2.11. The flaw affects the public link creation flow in PublicLinkController. Authenticated users holding the PUBLICLINK_CREATE profile flag can trigger unauthorized decryption of any vault account's password. The vulnerability stems from the absence of AccountAcl checks in the saveCreateFromAccountAction endpoint. Exploitation causes cleartext credentials to be serialized into Vault storage on the PublicLink database row. An attacker who later recovers the generated link hash can retrieve the plaintext password without authentication.

Critical Impact
Any authenticated sysPass user with public link creation privileges can decrypt and exfiltrate credentials for vault accounts they are not authorized to view.

Affected Products

sysPass through version 3.2.11
sysPass password manager self-hosted deployments
Any sysPass instance where users hold the PUBLICLINK_CREATE profile flag

Discovery Timeline

2026-07-24 - CVE-2026-65710 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-65710

Vulnerability Analysis

The vulnerability resides in the sysPass public link creation workflow. The saveCreateFromAccountAction endpoint in PublicLinkController accepts an arbitrary account identifier from an authenticated user. The controller then invokes AccountService::getDataForLink to load the target account. This code path does not apply AccountFilterUser restrictions and does not consult the per-account AccountAcl to verify the requesting user's read permission.

Because the account is loaded with elevated trust, the service proceeds to decrypt the stored credentials using the session master key. The resulting cleartext password is then serialized into a Vault object and persisted on the PublicLink database row. Any subsequent request that presents the generated link hash returns the cleartext password without further authentication.

The attacker requirement is limited to a valid session with the PUBLICLINK_CREATE profile flag, which is commonly granted to non-administrative roles in shared sysPass deployments.

Root Cause

The root cause is a missing authorization check in the public link creation flow. The controller trusts the caller's profile flag as sufficient authorization to create a link for any account. It does not verify that the caller has read access to the specific account being wrapped. The absence of AccountFilterUser and AccountAcl enforcement converts a per-user privilege into an effective cross-user decryption oracle.

Attack Vector

An attacker authenticates to sysPass with any account that carries the PUBLICLINK_CREATE profile flag. The attacker submits a crafted request to saveCreateFromAccountAction referencing the numeric identifier of a target vault account they do not own. sysPass creates the public link, decrypts the account password with the session master key, and stores the cleartext password inside the PublicLink row's Vault blob. The attacker then reads the link hash from the response or by querying their own created links, and retrieves the plaintext credential through the unauthenticated public link endpoint.

The vulnerability mechanism is documented in the GitHub CVE-2026-65710 Advisory and the VulnCheck Syspass Advisory.

Detection Methods for CVE-2026-65710

Indicators of Compromise

Unexpected rows in the PublicLink database table referencing accounts whose owners did not initiate the link creation.
Application logs showing saveCreateFromAccountAction invocations from user accounts that do not otherwise interact with the targeted accounts.
Public link retrievals from external IP addresses shortly after suspicious link creation events.

Detection Strategies

Audit the PublicLink table and correlate userId values with the owning userId of each referenced account. Mismatches indicate potential exploitation.
Review sysPass application and web server logs for high-frequency requests to the public link creation endpoint from a single authenticated session.
Monitor for enumeration patterns where a single user creates public links across a wide range of account IDs in a short interval.

Monitoring Recommendations

Enable verbose sysPass audit logging and forward events to a centralized SIEM for correlation across sessions and accounts.
Alert on any creation of public links by non-administrative users, and require review before the link becomes retrievable.
Track unauthenticated retrievals of public links and flag bursts of successful lookups that follow recent link creation activity.

How to Mitigate CVE-2026-65710

Immediate Actions Required

Revoke the PUBLICLINK_CREATE profile flag from all non-administrative users until a patched release is deployed.
Rotate all vault account passwords that may have been accessed by users holding the PUBLICLINK_CREATE flag.
Purge existing rows from the PublicLink table and invalidate outstanding link hashes.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Administrators should track the GitHub CVE-2026-65710 Advisory and the VulnCheck Syspass Advisory for updates. sysPass versions up to and including 3.2.11 are affected.

Workarounds

Disable the public link feature globally in sysPass configuration if it is not required for business operations.
Restrict the PUBLICLINK_CREATE profile flag to a small set of trusted administrators and audit their activity.
Place sysPass behind a reverse proxy that blocks unauthenticated access to the public link retrieval endpoint from untrusted networks.
Rotate the session master key and force re-authentication after removing untrusted users from public link privileges.

bash

# Configuration example: identify PublicLink rows created by users who do not own the referenced account
# Run against the sysPass database (adjust table/column names to your schema)
SELECT pl.id, pl.userId AS link_creator, a.id AS account_id, a.userId AS account_owner
FROM PublicLink pl
JOIN Account a ON a.id = pl.itemId
WHERE pl.userId <> a.userId;