# CVE-2026-65709: sysPass missing object-level authorization in JSON-RPC API

Source: https://junglewise.ai/threats/cve-2026-65709-syspass-missing-object-level-authorization-in-json-rpc-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-65709 · Severity: high · CVSS 8.3 · Published 2026-07-24

sysPass is a password management system used by organizations to securely store and share credentials. A security flaw in its programming interface (API) allows a user with a valid API token to view, modify, or delete any account in the system, even those they are not authorized to access. This could lead to the exposure of sensitive account metadata, unauthorized password resets, or the deletion of critical credentials across the entire organization.

## Quick answers

**Is CVE-2026-65709 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65709 being exploited in the wild.

**How severe is CVE-2026-65709?** High severity, with a CVSS score of 8.3, published 24 July 2026.

**Which products and versions are affected?** nuxsmin sysPass <= 3.2.11.

**Is there a fix for CVE-2026-65709?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65709 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65709?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing object-level authorization (BOLA) vulnerability exists in the JSON-RPC API of sysPass through version 3.2.11. While the API verifies if a token has permission to perform an action (e.g., 'edit'), it fails to verify if the token owner is authorized to access the specific account ID requested. Specifically, the AccountController methods viewAction, editAction, deleteAction, and editPassAction lack AccountFilterUser checks, unlike the viewPass method which is properly filtered. An authenticated attacker with a valid API token can exploit this to enumerate account metadata, overwrite passwords, or delete accounts across the entire vault. Remediation requires applying user-scoped authorization filters to all ID-based account API methods.

## Affected products

- nuxsmin sysPass <= 3.2.11

## Timeline

- 2026-07-24: advisory: NVD and VulnCheck published the advisory

## References

- [https://github.com/Caycon/cve-advisories/blob/main/2026/sysPass/CVE-2026-65709.md](https://github.com/Caycon/cve-advisories/blob/main/2026/sysPass/CVE-2026-65709.md)
- [https://www.vulncheck.com/advisories/syspass-missing-object-level-authorization-via-json-rpc-api](https://www.vulncheck.com/advisories/syspass-missing-object-level-authorization-via-json-rpc-api)