Executive brief
TSI DPDP CMS is an open-source consent management system used to handle personal data under India's DPDP Act. A missing authentication vulnerability allows unauthenticated attackers to create a Super Administrator account on fresh or reset deployments by sending a single HTTP request to the bootstrap setup endpoint, granting complete control over the system and all data it manages.
Technical details
The vulnerability is a missing authentication issue (CWE-306) in the POST /api/v1/bootstrap/setup endpoint and its associated setup wizard UI (/console/setup/init.html). The endpoint processes requests with a JSON payload to create a Super Administrator account without requiring any credentials. The only server-side protection is a state check that returns HTTP 500 if the system is already configured, which provides no protection on fresh deployments. An unauthenticated attacker can invoke the endpoint remotely and instantly gain administrative control. The issue affects versions up to 0.5.0, and a fix is available in version 0.5.1 and later.
Affected products
- tsi-coop tsi-dpdp-cms up to 0.5.0
Timeline
- 2026-09-02: disclosed
- 2026: patched: Fixed in version 0.5.1