# CVE-2026-108810: TSI DPDP CMS information disclosure via unauthenticated schema enumeration

Source: https://junglewise.ai/threats/cve-2026-108810-a-security-flaw-has-been-discovered-in-tsi-coop-tsi-dpdp-cms-0-5  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108810 · Severity: medium · CVSS 5.3 · Published 2026-10-12

TSI DPDP CMS is an open-source consent management system for India's data privacy regulations. An unauthenticated attacker can discover the internal API parameter schema by sending requests with partial data and reading field names from error messages, before the server checks authentication. This allows full mapping of sensitive API endpoints and their expected parameters without credentials, facilitating follow-up attacks.

Technologies: [Tsi-Coop Tsi-Dpdp-Cms](https://junglewise.ai/threats/technologies/tsi-dpdp-cms). Vendors: [Tsi-Coop](https://junglewise.ai/threats/vendors/tsi-coop).

## Quick answers

**Is CVE-2026-108810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108810 being exploited in the wild.

**How severe is CVE-2026-108810?** Medium severity, with a CVSS score of 5.3, published 12 October 2026.

**Which products and versions are affected?** Tsi-Coop Tsi-Dpdp-Cms 0.5.0, 0.5.1, 0.5.2.

**Is there a fix for CVE-2026-108810?** Yes: fixed in 0.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108810 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-108810?** Check whether you run Tsi-Coop Tsi-Dpdp-Cms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.5.3

## Technical details

The JSON schema validation in TSI DPDP CMS executes before authentication checks on multiple API endpoints. When a POST request is sent to endpoints like /api/v1/admin/job or /api/v1/admin/apikey with valid _func values but incomplete parameters, the server returns HTTP 400 with detailed error messages naming all missing required fields before checking authorization. An attacker can iteratively probe these endpoints with minimal parameters to fully enumerate the internal API schema, operation names, and field requirements without any credentials or authentication header.

## Affected products

- tsi-coop tsi-dpdp-cms 0.5.0, 0.5.1, 0.5.2

## Timeline

- 2026-10-12: disclosed: Published by NVD
- 2026-10-12: patched: Fixed version 0.5.3 released

## References

- [https://github.com/kavinkumarst/TSI-DPDP-CMS-API-Parameter-Schema-Enumerable-Without-Authentication/blob/main/README.md](https://github.com/kavinkumarst/TSI-DPDP-CMS-API-Parameter-Schema-Enumerable-Without-Authentication/blob/main/README.md)
- [https://github.com/tsi-coop/tsi-dpdp-cms/](https://github.com/tsi-coop/tsi-dpdp-cms/)

## Related threats

- [TSI DPDP CMS client-side authentication bypass](https://junglewise.ai/threats/cve-2026-84841-tsi-dpdp-cms-client-side-authentication-bypass)
- [TSI DPDP CMS missing authentication in bootstrap setup endpoint](https://junglewise.ai/threats/cve-2026-84840-tsi-dpdp-cms-missing-authentication-in-bootstrap-setup-endpoint)