Description
sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite config.xml, point the application at an attacker-controlled database, create an administrator account, and plant serialized PublicLink gadget chains triggered via account/viewLink to execute commands.
References
- www.cve.org/CVERecord ↗
- nvd.nist.gov/vuln/detail/CVE-2026-129110 ↗
- github.com/OpusProjects/sysPass/pull/360 ↗
- github.com/nuxsmin/sysPass ↗
- github.com/nuxsmin/sysPass/blob/3.2.11/app/modules/web/Controllers/InstallController.php ↗
- github.com/nuxsmin/sysPass/issues/1954 ↗
- www.vulncheck.com/advisories/syspass-3.0.1-through-3.2.11-unauthenticated-reinstallation-rce-via-install-install ↗
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.