Is CVE-2026-117472 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-117472 being exploited in the wild.

How severe is CVE-2026-117472?

Medium severity, with a CVSS score of 4.3, published 27 October 2026.

Which products and versions are affected?

Psono Server CE 4.0.33 through 7.2.3; Psono Server EE 4.0.33 through 7.2.3.

Is there a fix for CVE-2026-117472?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-117472 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-117472?

Check whether you run Psono Server CE or Psono Server EE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-117472: Psono Server authorization bypass in bulk-secret-read with URL_PREFIX

CVE-2026-117472 · Severity: medium · CVSS 4.3 · Published 2026-10-27

Psono Server is a password and secret management platform. In deployments using URL_PREFIX configuration, an attacker with a write-only API key can bypass read restrictions and retrieve encrypted secret data and nonces through a path comparison flaw. This allows unauthorized data exposure despite intentional permission restrictions.

Vendors: Psono.

Quick answers

Is CVE-2026-117472 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-117472 being exploited in the wild.
How severe is CVE-2026-117472?: Medium severity, with a CVSS score of 4.3, published 27 October 2026.
Which products and versions are affected?: Psono Server CE 4.0.33 through 7.2.3; Psono Server EE 4.0.33 through 7.2.3.
Is there a fix for CVE-2026-117472?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-117472 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-117472?: Check whether you run Psono Server CE or Psono Server EE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The bulk-secret-read endpoint compares the request path against a hard-coded unprefixed path, causing authorization bypass when URL_PREFIX is configured. An authenticated remote attacker with write scope but no read scope on their API key can exploit this path mismatch to access the endpoint with write-level authorization instead of the required read-level authorization. The vulnerability only affects deployments explicitly using URL_PREFIX; default configurations are unaffected.

Affected products

Psono Server CE 4.0.33 through 7.2.3
Psono Server EE 4.0.33 through 7.2.3

Timeline

2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.