Missing Authorization in TeamPass - #VU140727
Published: August 2, 2026
Vulnerability identifier: #VU140727
CSH Severity: Low
CVSS v4 BT: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in the show_details_item access gate in app/sources/items.queries.php when handling crafted item detail requests for unrestricted items while the "restrict items to roles" setting is enabled. A remote user can send a specially crafted request with attacker-controlled item and folder identifiers to disclose sensitive information.
Only metadata fields such as the label, login, url, email, and description are disclosed, while the password field is not exposed across the folder boundary. The issue also affects items in other users' personal folders.
Affected software
TeamPass
Remediation
Install security update from vendor's website.
TeamPass - update to 3.2.0.9