{"id":"CVE-2026-110972","kind":"vulnerability","aliases":["CVE-2026-110972"],"related":[],"title":"Płatnik: client-side login check lets attackers sign in as any user","description":"Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.\n\n\n\nThis issue was fixed in metric 242 in version 10.02.002.","summary":"Płatnik, a Polish payroll and social-insurance software product, performs its login check on the client side. An attacker with access to any application instance connected to the backend can bypass that check and log in as an arbitrary user.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["on-prem","other","payroll","płatnik"],"not_affected_if":["version-10.02.002-or-later"],"how_to_check":"- Confirm whether the team runs Płatnik and which version is installed; the sources do not give a check command or file.\n- Check the installed Płatnik version against `10.02.002` or later (metric 242).","fix":"- Płatnik: upgrade to version `10.02.002` (metric 242 is the fix).","status":"open","published_at":"2026-10-30T12:16:34+00:00","first_seen_at":"2026-10-30T12:30:22+00:00","triaged_at":"2026-10-30T12:32:00+00:00","updated_at":"2026-10-30T12:32:00+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T12:32:00Z","model":"claude-haiku-5-5","output":{"fix":"- Płatnik: upgrade to version `10.02.002` (metric 242 is the fix).","reach":"network","title":"Płatnik: client-side login check lets attackers sign in as any user","impact":"high","summary":"Płatnik, a Polish payroll and social-insurance software product, performs its login check on the client side. An attacker with access to any application instance connected to the backend can bypass that check and log in as an arbitrary user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["płatnik","payroll","on-prem"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker logs in as any user, reading or changing their data.","analyst_note":"Sources list only NVD; confirm affected version range and whether an attacker needs an existing client instance, via the vendor advisory.","how_to_check":"- Confirm whether the team runs Płatnik and which version is installed; the sources do not give a check command or file.\n- Check the installed Płatnik version against `10.02.002` or later (metric 242).","plain_action":"","needs_analyst":true,"not_affected_if":["version-10.02.002-or-later"],"who_is_affected":"Organizations running Płatnik whose application instances connect to the backend server; any client instance can be used to bypass the login check. Installations already on version 10.02.002 or later, with metric 242 applied, are fixed. Whether a given deployment is reachable from an attacker-controlled instance is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":4078,"output_tokens":549,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110972':16A,19A '-2026':15A,18A '10.02.002':107C '242':104C 'access':47B,76C 'applic':50B,79C 'arbitrari':65B,96C 'attack':8A,45B,74C 'authent':72C,93C 'backend':55B,84C 'bypass':57B,87C 'check':6A,39B,59B 'client':3A,42B,70C 'client-sid':2A,69C 'connect':52B,81C 'cve':14A,17A 'fix':101C 'instanc':51B,80C 'insur':33B 'issu':99C 'let':7A 'log':61B 'login':5A,38B,89C 'metric':103C 'on-prem':20B 'payrol':24B,29B 'perform':36B,68C 'polish':28B 'prem':22B 'process':91C 'product':35B 'płatnik':1A,25B,26B,67C 'server':85C 'side':4A,43B,71C 'sign':9A 'social':32B 'social-insur':31B 'softwar':34B 'user':13A,66B,97C 'verif':90C 'version':106C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Płatnik whose application instances connect to the backend server; any client instance can be used to bypass the login check. Installations already on version 10.02.002 or later, with metric 242 applied, are fixed. Whether a given deployment is reachable from an attacker-controlled instance is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110972","severity":null,"published_at":"2026-10-30T12:16:34+00:00","modified_at":"2026-10-30T12:16:34+00:00","first_seen_at":"2026-10-30T12:30:22+00:00","fetched_at":"2026-10-30T12:30:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}