Is CVE-2026-84841 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84841 being exploited in the wild.

How severe is CVE-2026-84841?

High severity, with a CVSS score of 7.3, published 2 September 2026.

Which products and versions are affected?

Tsi-Coop Tsi-Dpdp-Cms up to 0.5.0.

Is there a fix for CVE-2026-84841?

A patch was published on 2026-09-02: Fixed in version 0.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84841 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84841?

Check whether you run Tsi-Coop Tsi-Dpdp-Cms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84841: TSI DPDP CMS client-side authentication bypass

CVE-2026-84841 · Severity: high · CVSS 7.3 · Published 2026-09-02

TSI DPDP CMS is an open-source consent management system for India's data protection law. The system relies entirely on browser-side JavaScript to enforce authentication, allowing unauthenticated attackers to bypass login by making direct HTTP requests (e.g., via curl or Burp Suite). Attackers gain access to sensitive console pages, internal API endpoints, database field schemas, and complete application logic without credentials.

Technologies: Tsi-Coop Tsi-Dpdp-Cms. Vendors: Tsi-Coop.

Quick answers

Is CVE-2026-84841 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84841 being exploited in the wild.
How severe is CVE-2026-84841?: High severity, with a CVSS score of 7.3, published 2 September 2026.
Which products and versions are affected?: Tsi-Coop Tsi-Dpdp-Cms up to 0.5.0.
Is there a fix for CVE-2026-84841?: A patch was published on 2026-09-02: Fixed in version 0.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84841 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84841?: Check whether you run Tsi-Coop Tsi-Dpdp-Cms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability stems from client-side enforcement of server-side security (CWE-602) combined with missing authentication for critical functions (CWE-306). The application delivers all 17 admin and DPO console pages with HTTP 200 responses unconditionally—no server-side credential verification occurs before serving sensitive pages. Authentication is implemented solely as JavaScript code that reads an authToken from localStorage and redirects users to login; any HTTP client that does not execute JavaScript (curl, wget, Python, Burp) receives the full page source including 100+ KB of JavaScript application logic, 12+ internal REST API endpoints, 50+ function dispatch values, and complete API contracts. Attackers can enumerate all operations (breach management, ROPA lifecycle, API key generation, user administration, etc.) and construct authenticated requests once the localStorage format is known. Upgrade to version 0.5.1 or later to resolve this issue.

Affected products

TSI-Coop TSI DPDP CMS up to 0.5.0

Timeline

2026-09-02: disclosed
2026-09-02: patched: Fixed in version 0.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.