SB2026092267 - Multiple vulnerabilities in TeamPass

Description

This security bulletin contains information about 2 vulnerabilities.

1) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose item metadata from folders they are not authorized to access.

The vulnerability exists due to improper access control in the do_items_list_in_folder AJAX action when requesting later pages of results for a folder. A remote user can submit a crafted pagination request with a user-controlled folder identifier and pagination state to disclose item metadata from unauthorized folders.

Encrypted passwords are not returned by the affected query, and cleartext passwords are not directly disclosed.

2) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to copy items into folders they are not authorized to access.

The vulnerability exists due to authorization bypass through a user-controlled key in the `copy_item` action in `items.queries.php` when processing copy requests containing a destination folder identifier. A remote user can submit a copy request specifying a restricted destination folder to copy an accessible item into that folder.

Exploitation requires write access to at least one shared folder.

Remediation

Install update from vendor's website.

References

• https://github.com/nilsteampassnet/TeamPass/security/advisories/GHSA-xrjw-r5hx-29rj
• https://github.com/nilsteampassnet/TeamPass/security/advisories/GHSA-g797-4rh6-m2xp