CVE-2026-128970 · Package
NO FIX YET · SEE WHAT TO DO
Psono Server does not check that a user has accepted a group invitation before allowing deletion of that group's share-rights. An authenticated user who was invited to a share-admin group, and who knows a share-right UUID, can revoke the group's access to a shared secret.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Psono Server, in the Community Edition from 1.12.6 through 7.5.0 or the Enterprise Edition before 7.5.1. Exposure needs an authenticated account that has been invited to a group with share-admin privileges and knowledge of a group share-right UUID. Installations on hosted Psono services or on 7.5.1 or later are not affected.
Not affected if managed-hosting, no-group-shares, version-7.5.1-or-later
Who cares password-manager, psono, self-hosted
7.5.0 or earlier in the Community Edition (from 1.12.6) or any Enterprise Edition before 7.5.1 is affected.DELETE /share/right/ endpoint.Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the authenticated user, and share_admin=True, but omits accepted=True. An authenticated remote attacker who has been invited to a group with share-admin privileges, and who knows a group share-right UUID, can therefore delete that group's share-right record without accepting the invitation or after declining it. Pending invitations have accepted=None, while declined invitations retain accepted=False and the share_admin flag. Deletion revokes the group's access to the affected share and its contained secrets for all accepted group members, without deleting the underlying data or disclosing secret contents. The issue was fixed in version 7.5.1 of both editions, released on 2026-10-13.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
7.5.1.