CVE-2026-5652
Authorization Bypass Through User-Controlled Key in Crafty Controller
Summary
Authorization Bypass Through User-Controlled Key in Crafty Controller
Original description
The description as published by the source.
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
References
- advisory github.com
- advisory nvd.nist.gov
- web gitlab.com