Is CVE-2026-65708 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65708 being exploited in the wild.

How severe is CVE-2026-65708?

High severity, with a CVSS score of 8.1, published 24 July 2026.

Is there a fix for CVE-2026-65708?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-65708 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-65708?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65708: sysPass IDOR in AccountFileController

CVE-2026-65708 · Severity: high · CVSS 8.1 · Published 2026-07-24

sysPass is an open-source password manager used by organizations to securely store and share credentials. A security flaw allows any logged-in user to access, view, or delete file attachments belonging to other accounts, even if they shouldn't have permission to see them. This could lead to the theft of sensitive documents or the unauthorized modification of data stored within the password vault.

Quick answers

Is CVE-2026-65708 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65708 being exploited in the wild.
How severe is CVE-2026-65708?: High severity, with a CVSS score of 8.1, published 24 July 2026.
Which products and versions are affected?: nuxsmin sysPass <= 3.2.11.
Is there a fix for CVE-2026-65708?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-65708 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-65708?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the AccountFileController of sysPass through version 3.2.11. The application fails to perform adequate authorization checks when processing requests for file attachments. An authenticated attacker can exploit this by supplying arbitrary numeric file IDs to the download, view, delete, upload, and list actions. This allows the attacker to bypass Access Control List (ACL) permissions, enabling them to enumerate, retrieve, or delete any attachment stored in the vault regardless of account-level restrictions.

Affected products

nuxsmin sysPass <= 3.2.11

Timeline

2026-07-24: advisory: Vulnerability published by NVD and VulnCheck.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.