Live › vulnerability › CVE-2026-116471
Go to dashboardBKWLD Decoy, a PHP authorization package, has a flaw in Policy.php where the role argument is manipulated to bypass privilege checks. A remote attacker can gain privileges they should not have, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 19:32 UTC. All times on this page are UTC.
Applications that use BKWLD Decoy up to 5.11.1 for authorization, where the role value can be influenced from a request. Projects that do not use Decoy, or use a version past 5.11.1, are not listed as affected in the sources.
No product ranges from the sources yet.
5.11.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116471")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.