CVE-2026-117472 URL prefix handling permits API key read-scope bypass in Psono Server
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-117472?
CVE-2026-117472 is a medium-severity vulnerability in esaqa GmbH Psono, published on 27 Oct 2026.
Official description
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.
Weakness: CWE-863
Which versions are affected by CVE-2026-117472?
How do I fix CVE-2026-117472?
No fix has been published for CVE-2026-117472 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-117472 being exploited?
There is no known exploitation of CVE-2026-117472 in the wild and no public exploit code.
Sources
Also known as GHSA-4hh2-mhpm-69h3.