{"id":"CVE-2026-117472","revision":"d896b7b2e66549b9b329853b5b49a6c1","records":[{"revision":"d896b7b2e66549b9b329853b5b49a6c1","observedAt":"2026-10-27T07:22:55.98+00:00","statement":{"source":"cve-program","id":"CVE-2026-117472","aliases":[],"title":"URL prefix handling permits API key read-scope bypass in Psono Server","description":"Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.","state":0,"publishedAt":"2026-10-27T05:56:16.775+00:00","modifiedAt":"2026-10-27T05:56:16.775+00:00","affected":[{"ecosystem":"Vendor product","name":"Psono","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"esaqa GmbH\",\n                    \"product\": \"Psono\",\n                    \"repo\": \"https://gitlab.com/esaqa/psono/psono-server\",\n                    \"modules\": [\n                        \"Psono Server Community Edition\",\n                        \"Psono Server Enterprise Edition\"\n                    ],\n                    \"programFiles\": [\n                        \"psono/restapi/permissions.py\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.33\",\n                            \"lessThan\": \"7.2.4\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117472.md","https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/permissions.py","https://gitlab.com/esaqa/psono/psono-server/-/commit/5638d4be806af7d1dea03f7cad3927aa2bd19cf4","https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4","https://gitlab.com/esaqa/psono/psono-server"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117472","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-117472","identifiers":["CVE-2026-117472"]},"retained":false,"historicalAffected":[]}],"coverage":[]}