{"id":"CVE-2026-116471","kind":"vulnerability","aliases":["CVE-2026-116471"],"related":[],"title":"BKWLD Decoy: Policy.php role argument lets users gain improper privileges","description":"A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"BKWLD Decoy, a PHP authorization package, has a flaw in Policy.php where the role argument is manipulated to bypass privilege checks. A remote attacker can gain privileges they should not have, and a public exploit exists.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["decoy","laravel","package","php","self-hosted"],"not_affected_if":["not-using-decoy","version-above-5.11.1"],"how_to_check":"- Check the installed Decoy version in composer.lock or vendor/bkwld/decoy/composer.json, comparing against `5.11.1`\n- Review how role values reach the Authorization Policy in Policy.php for user-controlled input","fix":"- No fixed version is named in the sources; the vendor did not respond. Track the advisory for a patched release, or restrict role-based access checks to server-side values until one ships","status":"open","published_at":"2026-10-26T19:16:30+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","triaged_at":"2026-10-26T19:34:02+00:00","updated_at":"2026-10-26T19:34:02+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T19:34:01Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is named in the sources; the vendor did not respond. Track the advisory for a patched release, or restrict role-based access checks to server-side values until one ships","reach":"internet","title":"BKWLD Decoy: Policy.php role argument lets users gain improper privileges","impact":"medium","summary":"BKWLD Decoy, a PHP authorization package, has a flaw in Policy.php where the role argument is manipulated to bypass privilege checks. A remote attacker can gain privileges they should not have, and a public exploit exists.","category":"package","nicknames":[],"who_cares":["php","laravel","decoy","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker gains elevated privileges in the application's authorization model","analyst_note":"Confirm the affected role-handling code path and whether a patch exists; the NVD entry is the only source and the vendor is unresponsive.","how_to_check":"- Check the installed Decoy version in composer.lock or vendor/bkwld/decoy/composer.json, comparing against `5.11.1`\n- Review how role values reach the Authorization Policy in Policy.php for user-controlled input","needs_analyst":true,"not_affected_if":["not-using-decoy","version-above-5.11.1"],"who_is_affected":"Applications that use BKWLD Decoy up to 5.11.1 for authorization, where the role value can be influenced from a request. Projects that do not use Decoy, or use a version past 5.11.1, are not listed as affected in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000619,"input_tokens":3340,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116471':13A,16A '-2026':12A,15A '5.11.1':71C 'argument':5A,38B,92C 'attack':47B,100C,119C 'author':28B,86C 'bkwld':1A,24B,67C 'bypass':42B 'check':44B 'compon':85C 'contact':123C 'cve':11A,14A 'decoy':2A,17B,25B,68C 'disclosur':127C 'discov':65C 'earli':124C 'element':74C 'exist':59B 'exploit':58B,107C 'file':81C 'flaw':32B,62C 'function':78C 'gain':8A,49B 'host':23B 'impact':73C 'improp':9A,96C 'laravel':18B 'let':6A 'manag':98C 'manipul':40B,89C 'may':101C,115C 'packag':19B,29B 'perform':103C 'php':20B,27B 'polici':87C 'policy.php':3A,34B,82C 'privileg':10A,43B,50B,97C 'public':57B,113C 'releas':110C 'remot':46B,105C 'respond':131C 'result':94C 'role':4A,37B,93C 'secur':61C 'self':22B 'self-host':21B 'unknown':77C 'use':117C 'user':7A 'vendor':121C 'way':134C","nicknames":[],"mitigations":[],"who_affected":"Applications that use BKWLD Decoy up to 5.11.1 for authorization, where the role value can be influenced from a request. Projects that do not use Decoy, or use a version past 5.11.1, are not listed as affected in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T19:16:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116471","severity":null,"published_at":"2026-10-26T19:16:30+00:00","modified_at":"2026-10-26T19:16:30+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","fetched_at":"2026-10-26T19:32:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}