SB2026080207 - Multiple vulnerabilities in TeamPass

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080207

SB2026080207 - Multiple vulnerabilities in TeamPass

Published: August 2, 2026 Updated: August 3, 2026

Security Bulletin ID SB2026080207
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in a victim's browser session.

The vulnerability exists due to improper neutralization of input during web page generation in the recycle-bin frontend renderer when rendering deleted item labels returned by the recycle-bin listing API. A remote user can create and delete an item with a crafted HTML label through the REST API to execute arbitrary script in a victim's browser session.

User interaction is required, and exploitation requires REST API item create/delete permissions and a victim with access to the Utilities deletion page.


2) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through a user-controlled key in app/sources/users.logs.datatable.php when handling requests with a client-supplied userId parameter. A remote user can send a request with an arbitrary userId value to disclose sensitive information.

The endpoint is reachable through public/sources/users.logs.datatable.php and is gated only by the baseline items page permission. The issue can expose another user's item-access and system audit records, including accessed item labels, actions performed, and timestamps.


3) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through user-controlled key in app/sources/downloadFile.php when handling file-download requests in the pathIsFiles=1 branch. A remote user can supply a valid fileid for an accessible file while setting name to another file in the files folder to disclose sensitive information.

The issue is limited to files within the configured files folder, and exploitation requires knowledge or guessing of a target filename.


4) Improper privilege management (CVE-ID: N/A)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain unauthorized access to folders or modify content outside their intended scope.

The vulnerability exists due to improper privilege management in the `add_one_role_to_user` context of the `save_user_change` action in `app/sources/users.queries.php` when handling a user-supplied role id. A remote user can submit a crafted request with an unauthorized role id to gain unauthorized access to folders or modify content outside their intended scope.

For regular users, the observed behavior was self-assignment to an existing role, and the resulting access depended on role membership, folder ACLs, and item sharekeys in the deployment.


5) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to take over managed or non-administrator user accounts.

The vulnerability exists due to incorrect authorization in the legacy `newValue` update branch in `app/sources/users.queries.php` when handling user-management update requests with a non-empty `newValue` POST parameter. A remote user can submit crafted `pw`, `login`, or `email` field updates for an in-scope target user to take over managed or non-administrator user accounts.

The issue can be exploited by writing an attacker-controlled bcrypt hash into the password field or by rewriting the victim's email address and then triggering password recovery. The self-target path is also reachable by any user.


6) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: N/A)

CWE-ID: CWE-640 - Weak password recovery mechanism

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to reset a local user's password recovery state and bypass brute-force lockout protections.

The vulnerability exists due to a weak password recovery mechanism for forgotten password in app/sources/identify.php when handling the forgot local password flow after a failed login seeds session context. A remote attacker can send two specially crafted HTTP requests using the same unauthenticated session to reset a victim account's encryption keys, trigger delivery of a temporary password to the victim, and delete brute-force failure records to bypass brute-force lockout protections.

Exploitation requires the target account to use local authentication, have a registered email address, and not be disabled. Local password recovery must be enabled and SMTP must be configured.


7) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to reset two-factor authentication secrets for arbitrary accounts.

The vulnerability exists due to missing authentication for a critical function in the ga_generate_qr handler in app/sources/main.queries.php when handling crafted unauthenticated requests with demand_origin set to users_management_list. A remote attacker can send a specially crafted request to reset two-factor authentication secrets for arbitrary accounts.

The issue can affect existing users including administrators, and the operation overwrites the stored ga and ga_temporary_code values without requiring the target password.


8) Observable discrepancy (CVE-ID: N/A)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to enumerate valid usernames and verify guessed passwords for arbitrary accounts.

The vulnerability exists due to observable discrepancy and improper restriction of excessive authentication attempts in the ga_generate_qr handler in app/sources/main.queries.php when processing crafted unauthenticated requests for login enrollment. A remote attacker can send repeated specially crafted requests to enumerate valid usernames and verify guessed passwords for arbitrary accounts.

The responses differ for unknown usernames and wrong passwords, and this code path performs no brute-force accounting or lockout.


9) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to path traversal in app/sources/upload.files.php when handling file uploads. A remote user can upload a file with a traversal sequence in the name field and an attacker-controlled extension to execute arbitrary code.

Code execution requires the written file to land in a web-served directory that executes PHP and is writable by the web-server user.


10) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to sql injection in app/sources/users.logs.datatable.php when handling the top-level dir parameter in the ORDER BY clause. A remote user can send a specially crafted request to disclose sensitive information.

The affected endpoint is reachable by a baseline authenticated user role, and the injection supports error-based, boolean-based, and time-based extraction techniques.


11) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to authenticate as another user and take over that account.

The vulnerability exists due to improper authentication in app/sources/identify.php when processing a primary login request after an OAuth2 login flow. A remote user can submit a victim's username with an arbitrary password to authenticate as another user and take over that account.

Exploitation requires OAuth2 login to be enabled and the target account to use local or LDAP authentication. The issue can also permanently change the victim account's auth_type to oauth2.


12) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: N/A)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges to administrator.

The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes in the `save_user_change` case handler in `app/sources/users.queries.php` when handling profile-change requests. A remote user can send a specially crafted HTTP request with an attacker-controlled column name to escalate privileges to administrator.

The vulnerable action is accessible to authenticated non-read-only users, and managers can target arbitrary user IDs rather than only their own account.


Remediation

Install update from vendor's website.

References