Live › vulnerability › CVE-2026-110972
Płatnik, a Polish payroll and social-insurance software product, performs its login check on the client side. An attacker with access to any application instance connected to the backend can bypass that check and log in as an arbitrary user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Organizations running Płatnik whose application instances connect to the backend server; any client instance can be used to bypass the login check. Installations already on version 10.02.002 or later, with metric 242 applied, are fixed. Whether a given deployment is reachable from an attacker-controlled instance is unknown.
No product ranges from the sources yet.
10.02.002 or later (metric 242).10.02.002 (metric 242 is the fix).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.
This issue was fixed in metric 242 in version 10.02.002.
This page as .md · .json · in your agent: get_signal("CVE-2026-110972")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.