CVE-2026-23754 D-Link D-View 8 IDOR Allows Credential Disclosure and Account Takeover

High 8.7 Published 21 Jan 2026 Updated 14 May 2026

Authenticated users can exploit IDOR to retrieve other users' credentials, enabling full account takeover and administrative control.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-23754?

CVE-2026-23754 is a high-severity missing authorization vulnerability in D-Link D-View 8, published on 21 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credential material can be reused directly as a valid authentication secret, allowing full impersonation of the targeted account. This results in complete account takeover and full administrative control over the D-View system.

Weakness: CWE-639

Which versions are affected by CVE-2026-23754?

It affects 1 product.

Products include Dlink D-View 8.

How do I fix CVE-2026-23754?

No fix has been published for CVE-2026-23754 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-23754 being exploited?

There is no known exploitation of CVE-2026-23754 in the wild and no public exploit code.

Sources

Also known as GHSA-872q-6cm2-xcc6.