CVE-2026-85395
Last modified
CVE-2026-85395 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| unopim | unopim | < 2.1.3 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-85395?
How severe is CVE-2026-85395?
How do I fix CVE-2026-85395?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-8539Script injection in SanitizerAPI in Google Chrome on Android…5.4
- CVE-2026-85390Checkmate through 3.11.0 omits the isAllowed role guard midd…7.1
- CVE-2026-85391Peppermint through 0.5.5 contains a hardcoded JWT signing se…9.8
- CVE-2026-85392Peppermint through 0.5.5 contains an authorization bypass vu…4.3
- CVE-2026-85393node-forge through 1.4.0 fails to validate element count in …7.5
- CVE-2026-85394python-jose through 3.5.0 fails to properly validate asymmet…9.1
- CVE-2026-85396rubyzip versions before 3.4.0 contain a path traversal vulne…7.5
- CVE-2026-85397A vulnerability was determined in code-projects Hospital Inf…7.3
- CVE-2026-85398A vulnerability was identified in code-projects Hospital Inf…7.3
- CVE-2026-85399A security flaw has been discovered in code-projects Hospita…7.3
- CVE-2026-8540Type Confusion in V8 in Google Chrome prior to 148.0.7778.16…8.8
- CVE-2026-85401A weakness has been identified in Dolibarr up to 21.0.4/22.0…6.3
Are you affected by CVE-2026-85395?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST