SB2026092268 - Multiple vulnerabilities in TeamPass

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092268

SB2026092268 - Multiple vulnerabilities in TeamPass

Published: September 22, 2026

Security Bulletin ID SB2026092268
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 40% Medium 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to reactivate disabled accounts.

The vulnerability exists due to missing authentication for a critical function in the user_is_ready handler (userIsReady()) in sources/main.queries.php when processing pre-authentication requests. A remote attacker can send a crafted request containing a target user ID to reactivate disabled accounts.

Exploitation depends on the related pre-authentication dispatch bypass.


2) Unverified Password Change (CVE-ID: N/A)

CWE-ID: CWE-620 - Unverified Password Change

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to take over arbitrary local accounts.

The vulnerability exists due to an unverified password change in the initializeUserPassword() handler in sources/main.queries.php when processing pre-authentication password-reset requests for local non-LDAP accounts. A remote attacker can send a crafted password-reset request to take over arbitrary local accounts.

The password-reset operation regenerates the target user's encryption key pair, causing vault items encrypted with the old key to become unreadable.


3) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to SQL injection in the getUserInfo() function in sources/main.queries.php when processing a client-supplied fields POST parameter. A remote attacker can submit a crafted fields parameter containing SQL expressions or subqueries to disclose sensitive information.

Exploitation requires the related pre-authentication dispatch bypass to reach the handler without credentials.


4) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to missing authentication for a critical function in the generateBugReport() handler in sources/main.queries.php when processing crafted POST requests. A remote attacker can send a specially crafted request to disclose sensitive information.

Exploitation depends on the separately reported pre-authentication dispatch bypass.


5) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to invoke internal action handlers without authentication.

The vulnerability exists due to missing authentication for a critical function in the sources/main.queries.php mainQuery() dispatch guard when processing HTTP requests. A remote attacker can send a crafted HTTP POST request to invoke internal action handlers without authentication.

The bypass can occur through automatic CPM session creation or by including a non-empty POST data field.


Remediation

Install update from vendor's website.

References