Executive brief
sysPass is a password management system used by organizations to securely store and share credentials. A security flaw in its programming interface (API) allows a user with a valid API token to view, modify, or delete any account in the system, even those they are not authorized to access. This could lead to the exposure of sensitive account metadata, unauthorized password resets, or the deletion of critical credentials across the entire organization.
Technical details
A missing object-level authorization (BOLA) vulnerability exists in the JSON-RPC API of sysPass through version 3.2.11. While the API verifies if a token has permission to perform an action (e.g., 'edit'), it fails to verify if the token owner is authorized to access the specific account ID requested. Specifically, the AccountController methods viewAction, editAction, deleteAction, and editPassAction lack AccountFilterUser checks, unlike the viewPass method which is properly filtered. An authenticated attacker with a valid API token can exploit this to enumerate account metadata, overwrite passwords, or delete accounts across the entire vault. Remediation requires applying user-scoped authorization filters to all ID-based account API methods.
Affected products
- nuxsmin sysPass <= 3.2.11
Timeline
- 2026-07-24: advisory: NVD and VulnCheck published the advisory