CVE-2026-5652 Authorization Bypass Through User-Controlled Key in Crafty Controller
Authenticated attackers can modify other users' data via insecure direct object reference in the Users API of Crafty Controller.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-5652?
CVE-2026-5652 is a critical missing authorization vulnerability in Arcadia Technology, LLC Crafty Controller, published on 21 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
Weakness: CWE-639
Which versions are affected by CVE-2026-5652?
It affects 1 product.
Products include Craftycontrol Crafty Controller.
How do I fix CVE-2026-5652?
No fix has been published for CVE-2026-5652 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-5652 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-5652 exists.
Other vulnerabilities in Arcadia Technology, LLC Crafty Controller
- CVE-2026-0963 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller
- CVE-2025-14700 Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller
- CVE-2026-13716 Path Traversal: '.../...//' in Crafty Controller
- CVE-2026-0805 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller
- CVE-2025-5990 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
Sources
Also known as GHSA-8mj7-3xh5-xpj7.