CVE-2026-65709 — sysPass JSON-RPC Broken Object-Level Authorization (BOLA/IDOR)¶

Key facts

CVE-2026-65709 is a High (8.3) vulnerability: sysPass JSON-RPC Broken Object-Level Authorization (BOLA/IDOR). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-65709
Severity	High (8.3)
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2026/CVE-2026-65709/

Details¶

CVE-2026-65709 is a High (8.3) vulnerability: sysPass JSON-RPC Broken Object-Level Authorization (BOLA/IDOR). This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.


CVSS v3	8.3 (High)
CWE	CWE-639 Authorization Bypass Through User-Controlled Key
Affected	sysPass ≤ 3.2.11
Vector	Network / API-token authenticated

For authorized security testing, CTF, and research only.

Summary¶

sysPass's JSON-RPC API is missing object-level authorization. Any valid API-token holder can invoke AccountController methods — viewAction, editAction, deleteAction, editPassAction — against any account id, bypassing the per-account AccountFilterUser checks. This lets a low-privileged token enumerate account metadata, overwrite passwords, and delete accounts across the entire vault.

Root cause¶

The API authenticates the token but does not verify that the token's owner is authorized for the specific accountId requested. The fix reintroduces AccountFilterUser scoping on every account operation.

Detection (`poc.py`)¶

Non-destructive: with a low-privilege API token, calls the read-only account/viewAction for an accountId known to be outside the token's scope. If account data is returned, the target is VULNERABLE. The script never calls edit, delete, or editPass.

python poc.py --target http://TARGET:3080 --token <API_TOKEN> --account-id 2

Lab¶

docker compose up --build      # vulnerable on :3080, patched on :3081
./run-tests.sh

Remediation¶

Upgrade sysPass beyond 3.2.11 (apply the AccountFilterUser fix).
Scope API tokens narrowly; audit deleteAction / editPassAction usage.
Apply prevention/ rules to detect cross-scope account RPC calls.

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-65709, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-65709 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2026-65709 — sysPass JSON-RPC BOLA (Snort/Suricata)
# Detect destructive account RPC methods and enumeration over /api.php.

alert http $EXTERNAL_NET any -> $HOME_NET any ( \
    msg:"CVE-2026-65709 sysPass destructive account RPC (delete/editPass)"; \
    flow:established,to_server; http.method; content:"POST"; \
    http.uri; content:"/api.php"; \
    http.request_body; pcre:"/account\/(delete|editPass)Action/i"; \
    classtype:web-application-attack; sid:2026065709; rev:1; )

alert http $EXTERNAL_NET any -> $HOME_NET any ( \
    msg:"CVE-2026-65709 sysPass account view/edit RPC (possible BOLA enum)"; \
    flow:established,to_server; http.method; content:"POST"; \
    http.uri; content:"/api.php"; \
    http.request_body; pcre:"/account\/(view|edit)Action/i"; \
    threshold:type threshold, track by_src, count 20, seconds 60; \
    classtype:web-application-attack; sid:2026065710; rev:1; )

:material-file-download: prevention/snort.rules

/*
 * CVE-2026-65709 — sysPass JSON-RPC BOLA
 * Detect exfiltrated/dumped sysPass account records (bulk vault disclosure).
 */

rule CVE_2026_65709_syspass_account_dump
{
    meta:
        cve = "CVE-2026-65709"
        description = "Bulk sysPass account records exfiltrated via JSON-RPC BOLA"
        severity = "high"
    strings:
        $rpc = "account/viewAction" ascii nocase
        $t = "authToken" ascii
        $j = "jsonrpc" ascii nocase
        $f1 = "\"login\"" ascii
        $f2 = "\"pass\"" ascii
        $f3 = "\"name\"" ascii
    condition:
        ($rpc and $t and $j) or (2 of ($f1, $f2, $f3) and #f3 > 5)
}

:material-file-download: prevention/yara.yar

# CVE-2026-65709 — sysPass JSON-RPC BOLA
# The API cannot verify per-account ownership at the edge, so the compensating
# controls are: restrict the API surface, rate-limit enumeration, and block the
# destructive RPC methods unless the API is explicitly needed.

limit_req_zone $binary_remote_addr zone=syspass_api:10m rate=10r/m;

location = /api.php {
    # Restrict the JSON-RPC API to trusted automation hosts only.
    allow 10.0.0.0/8;          # <- adjust
    deny  all;

    limit_req zone=syspass_api burst=5 nodelay;

    # Block destructive account methods at the edge (needs the njs/lua body
    # inspection module; otherwise enforce via ModSecurity — see httpd.conf).
    proxy_pass http://127.0.0.1:3080;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}

:material-file-download: prevention/nginx.conf

# CVE-2026-65709 — sysPass JSON-RPC BOLA (Apache + ModSecurity)

# Block destructive account RPC methods over the API (enable only if unused).
SecRule REQUEST_URI "@endsWith /api.php" \
    "id:2026065709,phase:2,deny,status:403,log,\
     msg:'CVE-2026-65709 destructive sysPass account RPC blocked',chain"
    SecRule REQUEST_BODY "@rx account/(delete|editPass)Action" "t:none"

# Alert on rapid account enumeration via viewAction/editAction (BOLA probing).
SecAction "id:2026065710,phase:1,pass,nolog,initcol:ip=%{REMOTE_ADDR},setvar:ip.acct=+0"
SecRule REQUEST_URI "@endsWith /api.php" \
    "id:2026065711,phase:2,pass,log,\
     msg:'CVE-2026-65709 sysPass account RPC enumeration',chain"
    SecRule REQUEST_BODY "@rx account/(view|edit)Action" \
        "setvar:ip.acct=+1,expirevar:ip.acct=60"
SecRule IP:ACCT "@gt 20" \
    "id:2026065712,phase:2,deny,status:429,log,\
     msg:'CVE-2026-65709 sysPass account RPC flood (possible BOLA sweep)'"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-65709?¶

CVE-2026-65709 is a High (8.3) vulnerability: sysPass JSON-RPC Broken Object-Level Authorization (BOLA/IDOR). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-65709?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-65709?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.