{"id":"CVE-2026-129110","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-129110","summary":"sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install…","details":"sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite config.xml, point the application at an attacker-controlled database, create an administrator account, and plant serialized PublicLink gadget chains triggered via account/viewLink to execute commands.","published":"2026-11-13T16:19:00.543","modified":"2026-11-13T16:19:00.700","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/OpusProjects/sysPass/pull/360","label":"OpusProjects/sysPass#360"},"references":[{"type":"WEB","url":"https://github.com/OpusProjects/sysPass/pull/360"},{"type":"WEB","url":"https://github.com/nuxsmin/sysPass"},{"type":"WEB","url":"https://github.com/nuxsmin/sysPass/blob/3.2.11/app/modules/web/Controllers/InstallController.php#L80-L110"},{"type":"WEB","url":"https://github.com/nuxsmin/sysPass/issues/1954"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/syspass-3.0.1-through-3.2.11-unauthenticated-reinstallation-rce-via-install-install"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-13T16:19:00.700"}}