CVE-2026-8077 Weak credentials vulnerability in the CashDro 3 web administration panel
Attackers can bypass frontend restrictions by modifying JSON permissions to gain full administrative access to the CashDro 3 web panel.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8077?
CVE-2026-8077 is a high-severity missing authorization vulnerability in CashDro 3 Administration Panel, published on 8 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. The backend lacks authorization controls, leaving security entirely to the frontend. By modifying the binary string in the ‘Permissions’ field of the JSON response, an attacker could escalate privileges and gain full administrative access. This vulnerability allows all restrictions to be bypassed and completely compromises system management.
Weakness: CWE-862
Which versions are affected by CVE-2026-8077?
How do I fix CVE-2026-8077?
No fix has been published for CVE-2026-8077 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-8077 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8077 exists.
Sources
Also known as GHSA-j4mr-3f43-qwmq.