CVE-2026-84430 gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes
Attackers can modify arbitrary object attributes via the edit_personal endpoint, requiring authentication but allowing unauthorized data changes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84430?
CVE-2026-84430 is a medium-severity vulnerability in gouguoa, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised.
Which versions are affected by CVE-2026-84430?
How do I fix CVE-2026-84430?
No fix has been published for CVE-2026-84430 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-84430 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84430 exists.
Sources
Also known as GHSA-vxcj-vv77-fr73.