CVE-2026-5652

Published: Apr 21, 2026Modified: Jun 17, 2026

9.0

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Exploitability: 2.3 / Impact: 6.0

Source: cve@gitlab.com (Secondary)

Description

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.

Affected (1)

Products: Craftycontrol: Crafty Controller

Craftycontrol

1 product

Crafty Controller

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Craftycontrol Crafty Controller	Before 4.10.4

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://gitlab.com/crafty-controller/crafty-4/-/work_items/705

Source: cve@gitlab.com

ExploitVendor Advisory

https://gitlab.com/crafty-controller/crafty-4/-/work_items/705

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.