SB2026080206 - Missing Authorization in TeamPass

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080206

SB2026080206 - Missing Authorization in TeamPass

Published: August 2, 2026

Security Bulletin ID SB2026080206
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in the show_details_item access gate in app/sources/items.queries.php when handling crafted item detail requests for unrestricted items while the "restrict items to roles" setting is enabled. A remote user can send a specially crafted request with attacker-controlled item and folder identifiers to disclose sensitive information.

Only metadata fields such as the label, login, url, email, and description are disclosed, while the password field is not exposed across the folder boundary. The issue also affects items in other users' personal folders.


Remediation

Install update from vendor's website.

References