CVE-2021-44877

Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability has been found while using a temporary generated token in order to consume api resources. The vulnerability allows an unauthenticated attacker to use an api endpoint to generate a temporary JWT token that is designed to reference the correct tenant prior to authentication, to request system configuration parameters using direct api requests. The correct exploitation of this vulnerability causes sensitive information exposure. In case the tenant has an smtp credential set, the full credential information is disclosed.

• https://www.systeam.com.br/cve/broken-access-control-en.txtVendor Advisory
• https://www.systeam.com.br/cve/broken-access-control-en.txtVendor Advisory

Published

Dec 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44864TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerab…6.5
• CVE-2021-44866An issue was discovered in Online-Movie-Ticket-Booking-Syste…7.5
• CVE-2021-44868A problem was found in ming-soft MCMS v5.1. There is a sql i…9.8
• CVE-2021-44874Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to I…8.8
• CVE-2021-44875Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to U…5.3
• CVE-2021-44876Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to U…5.3
• CVE-2021-44878If an OpenID Connect provider supports the "none" algorithm …7.5
• CVE-2021-44879In gc_data_segment in fs/f2fs/gc.c in the Linux kernel befor…5.5
• CVE-2021-44880D-Link devices DIR_878 DIR_878_FW1.30B08_Hotfix_02 and DIR_8…9.8
• CVE-2021-44881D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discov…9.8
• CVE-2021-44882D-Link device DIR_878_FW1.30B08_Hotfix_02 was discovered to …9.8
• CVE-2021-44886In Zammad 5.0.2, agents can configure "out of office" period…5.3