CVE-2026-6571
kodcloud KodExplorer systemRole.class.php roleGroupAction authorization
- State
- Published
- Severity
- 5.3 Medium
- Published
- Apr 19, 2026
- Updated
- Apr 20, 2026
- Reserved
- Apr 18, 2026
Description
A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/systemRole.class.php. Executing a manipulation of the argument group_role can lead to authorization bypass. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
KodExplorerkodcloud |
|
References
- VDB-358205 | kodcloud KodExplorer systemRole.class.php roleGroupAction authorizationvdb-entrytechnical-description
- VDB-358205 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #789987 | KodExplorer 4.52 Authorization Bypassthird-party-advisory
- https://vulnplus-note.wetolink.com/share/atu3UbqnfAgsbroken-linkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.