CVE-2026-17038
Use of Hard-coded Credentials in drEryk Gabinet
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 10, 2026
- Updated
- Sep 10, 2026
- Reserved
- Jul 24, 2026
Description
DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-798 Use of Hard-coded Credentials
Affected Products
| Product | Versions |
|---|---|
drEryk GabinetdrEryk |
|
References
- https://dreryk.pl/produkty/gabinet/product
- https://cert.pl/posts/2026/09/CVE-2026-17038third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.