SB2026080207 - Multiple vulnerabilities in TeamPass

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080207

SB2026080207 - Multiple vulnerabilities in TeamPass

Published: August 2, 2026

Security Bulletin ID SB2026080207
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 63% Low 38%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in a victim's browser session.

The vulnerability exists due to improper neutralization of input during web page generation in the recycle-bin frontend renderer when rendering deleted item labels returned by the recycle-bin listing API. A remote user can create and delete an item with a crafted HTML label through the REST API to execute arbitrary script in a victim's browser session.

User interaction is required, and exploitation requires REST API item create/delete permissions and a victim with access to the Utilities deletion page.


2) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through a user-controlled key in app/sources/users.logs.datatable.php when handling requests with a client-supplied userId parameter. A remote user can send a request with an arbitrary userId value to disclose sensitive information.

The endpoint is reachable through public/sources/users.logs.datatable.php and is gated only by the baseline items page permission. The issue can expose another user's item-access and system audit records, including accessed item labels, actions performed, and timestamps.


3) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through user-controlled key in app/sources/downloadFile.php when handling file-download requests in the pathIsFiles=1 branch. A remote user can supply a valid fileid for an accessible file while setting name to another file in the files folder to disclose sensitive information.

The issue is limited to files within the configured files folder, and exploitation requires knowledge or guessing of a target filename.


4) Improper privilege management (CVE-ID: N/A)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to gain unauthorized access to folders or modify content outside their intended scope.

The vulnerability exists due to improper privilege management in the `add_one_role_to_user` context of the `save_user_change` action in `app/sources/users.queries.php` when handling a user-supplied role id. A remote user can submit a crafted request with an unauthorized role id to gain unauthorized access to folders or modify content outside their intended scope.

For regular users, the observed behavior was self-assignment to an existing role, and the resulting access depended on role membership, folder ACLs, and item sharekeys in the deployment.


5) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to take over managed or non-administrator user accounts.

The vulnerability exists due to incorrect authorization in the legacy `newValue` update branch in `app/sources/users.queries.php` when handling user-management update requests with a non-empty `newValue` POST parameter. A remote user can submit crafted `pw`, `login`, or `email` field updates for an in-scope target user to take over managed or non-administrator user accounts.

The issue can be exploited by writing an attacker-controlled bcrypt hash into the password field or by rewriting the victim's email address and then triggering password recovery. The self-target path is also reachable by any user.


6) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: N/A)

CWE-ID: CWE-640 - Weak password recovery mechanism

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to reset a local user's password recovery state and bypass brute-force lockout protections.

The vulnerability exists due to a weak password recovery mechanism for forgotten password in app/sources/identify.php when handling the forgot local password flow after a failed login seeds session context. A remote attacker can send two specially crafted HTTP requests using the same unauthenticated session to reset a victim account's encryption keys, trigger delivery of a temporary password to the victim, and delete brute-force failure records to bypass brute-force lockout protections.

Exploitation requires the target account to use local authentication, have a registered email address, and not be disabled. Local password recovery must be enabled and SMTP must be configured.


7) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to reset two-factor authentication secrets for arbitrary accounts.

The vulnerability exists due to missing authentication for a critical function in the ga_generate_qr handler in app/sources/main.queries.php when handling crafted unauthenticated requests with demand_origin set to users_management_list. A remote attacker can send a specially crafted request to reset two-factor authentication secrets for arbitrary accounts.

The issue can affect existing users including administrators, and the operation overwrites the stored ga and ga_temporary_code values without requiring the target password.


8) Observable discrepancy (CVE-ID: N/A)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to enumerate valid usernames and verify guessed passwords for arbitrary accounts.

The vulnerability exists due to observable discrepancy and improper restriction of excessive authentication attempts in the ga_generate_qr handler in app/sources/main.queries.php when processing crafted unauthenticated requests for login enrollment. A remote attacker can send repeated specially crafted requests to enumerate valid usernames and verify guessed passwords for arbitrary accounts.

The responses differ for unknown usernames and wrong passwords, and this code path performs no brute-force accounting or lockout.


Remediation

Install update from vendor's website.

References