Executive brief
sysPass is a password management system used by organizations to securely store and share credentials. A security flaw allows an authorized user to bypass access controls and generate a public sharing link for any password in the system, even those they are not permitted to see. If the attacker can obtain the resulting link, they can view sensitive administrative or corporate passwords in cleartext, potentially leading to a full breach of other systems.
Technical details
A missing authorization check (CWE-639/CWE-284) exists in the PublicLinkController of sysPass through version 3.2.11. While the application verifies if a user has the 'PUBLICLINK_CREATE' permission, it fails to perform AccountAcl or AccountFilterUser checks on the specific account being shared. An authenticated attacker can invoke the 'saveCreateFromAccountAction' endpoint with an arbitrary 'accountId' to force the 'AccountService::getDataForLink' method to load and decrypt credentials using the session's master key. The decrypted password is then serialized into the PublicLink database row. If the attacker can recover the generated link hash (via logs, notifications, or other information leaks), they can achieve unauthenticated cleartext password disclosure.
Affected products
- nuxsmin sysPass <= 3.2.11
Timeline
- 2026-07-24: disclosed
- 2026-07-24: advisory