Executive brief
sysPass is an open-source password manager used by organizations to securely store and share credentials. A security flaw allows any logged-in user to access, view, or delete file attachments belonging to other accounts, even if they shouldn't have permission to see them. This could lead to the theft of sensitive documents or the unauthorized modification of data stored within the password vault.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the AccountFileController of sysPass through version 3.2.11. The application fails to perform adequate authorization checks when processing requests for file attachments. An authenticated attacker can exploit this by supplying arbitrary numeric file IDs to the download, view, delete, upload, and list actions. This allows the attacker to bypass Access Control List (ACL) permissions, enabling them to enumerate, retrieve, or delete any attachment stored in the vault regardless of account-level restrictions.
Affected products
- nuxsmin sysPass <= 3.2.11
Timeline
- 2026-07-24: advisory: Vulnerability published by NVD and VulnCheck.