CVE-2026-84839: tsi-dpdp-cms Authentication Bypass Vulnerability

CVE-2026-84839 Overview

CVE-2026-84839 is a missing authentication vulnerability affecting tsi-coop tsi-dpdp-cms versions up to and including 0.5.0. The flaw resides in the web.xml configuration of the Admin Console and DPO Compliance Console component. Because the deployment descriptor fails to enforce authentication on protected resources, remote attackers can reach administrative functionality without providing credentials. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse. The vendor addressed the issue in version 0.5.1, and administrators should upgrade the affected component.

Critical Impact
Unauthenticated remote attackers can reach the DPO Compliance Console of vulnerable tsi-dpdp-cms deployments, exposing data protection administration functions.

Affected Products

tsi-coop tsi-dpdp-cms versions up to 0.5.0
Admin Console component shipped in tsi-dpdp-cms
DPO Compliance Console component shipped in tsi-dpdp-cms

Discovery Timeline

2026-09-02 - CVE-2026-84839 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84839

Vulnerability Analysis

The vulnerability is classified as Missing Authentication for Critical Function [CWE-287]. The affected tsi-dpdp-cms application ships a Java web.xml deployment descriptor that governs servlet security constraints. In versions up to 0.5.0, the descriptor does not require authentication on the Admin Console and DPO Compliance Console paths. As a result, unauthenticated network requests can reach administrative endpoints intended for privileged users. The disclosure indicates the attack is remotely exploitable with low complexity and no user interaction. Public disclosure of the exploit lowers the barrier for attackers scanning for exposed instances.

Root Cause

The root cause is an incomplete or missing <security-constraint> and <auth-constraint> declaration in the servlet container's web.xml for the Admin Console/DPO Compliance Console. Without those declarations, the servlet container serves protected resources without invoking any authentication mechanism, effectively bypassing access controls on administrative functionality.

Attack Vector

An attacker sends HTTP requests directly to the Admin Console or DPO Compliance Console URLs over the network. Because the servlet container does not challenge for credentials, the attacker receives access to administrative views and actions exposed by those consoles. See the GitHub security fix documentation and the public disclosure README for reproduction details.

No verified exploit code is reproduced here. Consult the VulDB entry for CVE-2026-84839 for additional technical context.

Detection Methods for CVE-2026-84839

Indicators of Compromise

Unauthenticated HTTP requests reaching Admin Console or DPO Compliance Console URLs of tsi-dpdp-cms deployments.
Access log entries showing successful 200 OK responses to administrative paths without a preceding authentication flow.
Configuration changes or data exports originating from IP addresses not associated with administrative users.

Detection Strategies

Audit deployed web.xml files for tsi-dpdp-cms to verify presence of <security-constraint> and <auth-constraint> on administrative URL patterns.
Compare installed component versions against the fixed release 0.5.1 referenced in the v0.5.1 release notes.
Inspect web server and application logs for administrative endpoint access outside expected maintenance windows or user populations.

Monitoring Recommendations

Alert on any HTTP access to tsi-dpdp-cms administrative paths that does not carry a valid authenticated session identifier.
Track configuration and policy modifications in the DPO Compliance Console and correlate them against a known list of authorized administrators.
Forward web server, application, and audit logs to a centralized analytics platform for retention and query.

How to Mitigate CVE-2026-84839

Immediate Actions Required

Upgrade tsi-dpdp-cms to version 0.5.1 or later, as directed by the vendor.
Restrict network exposure of the Admin Console and DPO Compliance Console to trusted management networks until the upgrade is complete.
Review access logs for evidence of unauthenticated administrative access prior to remediation and reset any credentials or secrets that may have been exposed.

Patch Information

The vendor fixed the issue in tsi-dpdp-cms0.5.1. Refer to the GitHub release v0.5.1 and the security fix documentation for change details. The upstream project is hosted at the tsi-coop/tsi-dpdp-cms repository.

Workarounds

Place the affected application behind a reverse proxy or web application firewall that enforces authentication on Admin Console and DPO Compliance Console paths.
Add explicit <security-constraint> and <login-config> entries to web.xml for administrative URL patterns pending the upgrade.
Limit inbound access to administrative endpoints via network ACLs, VPN, or IP allowlists.

bash

# Configuration example
# Not applicable - upgrade tsi-dpdp-cms to version 0.5.1 or later per vendor guidance.