{"id":"CVE-2026-128970","kind":"vulnerability","aliases":["CVE-2026-128970"],"related":[],"title":"Psono Server: pending group invitee can revoke a group's share rights","description":"Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the authenticated user, and share_admin=True, but omits accepted=True. An authenticated remote attacker who has been invited to a group with share-admin privileges, and who knows a group share-right UUID, can therefore delete that group's share-right record without accepting the invitation or after declining it. Pending invitations have accepted=None, while declined invitations retain accepted=False and the share_admin flag. Deletion revokes the group's access to the affected share and its contained secrets for all accepted group members, without deleting the underlying data or disclosing secret contents. The issue was fixed in version 7.5.1 of both editions, released on 2026-10-13.","summary":"Psono Server does not check that a user has accepted a group invitation before allowing deletion of that group's share-rights. An authenticated user who was invited to a share-admin group, and who knows a share-right UUID, can revoke the group's access to a shared secret.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","password-manager","psono","self-hosted"],"not_affected_if":["managed-hosting","no-group-shares","version-7.5.1-or-later"],"how_to_check":"- Check the Psono Server version: `7.5.0` or earlier in the Community Edition (from `1.12.6`) or any Enterprise Edition before `7.5.1` is affected.\n- Confirm whether untrusted or newly invited accounts can reach the server's `DELETE /share/right/` endpoint.","fix":"- Psono Server Community Edition and Enterprise Edition: move to `7.5.1`.","status":"open","published_at":"2026-11-13T15:17:45+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","triaged_at":"2026-11-13T15:48:58+00:00","updated_at":"2026-11-13T15:48:58+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T15:48:58Z","model":"claude-haiku-5-5","output":{"fix":"- Psono Server Community Edition and Enterprise Edition: move to `7.5.1`.","reach":"network","title":"Psono Server: pending group invitee can revoke a group's share rights","impact":"low","summary":"Psono Server does not check that a user has accepted a group invitation before allowing deletion of that group's share-rights. An authenticated user who was invited to a share-admin group, and who knows a share-right UUID, can revoke the group's access to a shared secret.","audience":"businesses","category":"package","nicknames":[],"who_cares":["psono","self-hosted","password-manager"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"group loses access to a shared secret; secret contents not disclosed","analyst_note":"","how_to_check":"- Check the Psono Server version: `7.5.0` or earlier in the Community Edition (from `1.12.6`) or any Enterprise Edition before `7.5.1` is affected.\n- Confirm whether untrusted or newly invited accounts can reach the server's `DELETE /share/right/` endpoint.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-7.5.1-or-later","managed-hosting","no-group-shares"],"who_is_affected":"Teams that self-host Psono Server, in the Community Edition from `1.12.6` through `7.5.0` or the Enterprise Edition before `7.5.1`. Exposure needs an authenticated account that has been invited to a group with share-admin privileges and knowledge of a group share-right UUID. Installations on hosted Psono services or on `7.5.1` or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000778,"input_tokens":4775,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':232C '-128970':15A,18A '-13':233C '-2026':14A,17A '/share/right':111C '1.12.6':85C '2026':231C '7.5.0':87C '7.5.1':94C,225C 'accept':36B,98C,130C,168C,178C,184C,207C 'access':75B,196C 'admin':60B,126C,146C,189C 'affect':199C 'allow':41B 'attack':135C 'authent':51B,122C,133C 'author':102C 'check':31B,113C 'communiti':82C 'contain':203C 'content':218C 'cve':13A,16A 'data':214C 'declin':173C,181C 'delet':42B,103C,110C,159C,191C,211C 'disclos':216C 'edit':83C,92C,228C 'endpoint':112C 'enterpris':91C 'fals':185C 'fix':222C 'flag':190C 'group':4A,9A,38B,45B,61B,73B,99C,105C,120C,142C,152C,161C,194C,208C 'host':26B 'invit':39B,55B,139C,170C,176C,182C 'invite':5A 'issu':220C 'know':64B,150C 'manag':22B 'match':117C 'member':209C 'membership':100C,116C 'none':179C 'omit':129C 'packag':19B 'password':21B 'password-manag':20B 'pend':3A,175C 'privileg':147C 'psono':1A,23B,27B,80C,89C 'record':166C 'releas':229C 'remot':134C 'requir':97C 'retain':183C 'revok':7A,71B,192C 'right':12A,49B,68B,108C,155C,165C 'secret':79B,204C,217C 'self':25B 'self-host':24B 'server':2A,28B,81C,90C 'share':11A,48B,59B,67B,78B,107C,125C,145C,154C,164C,188C,200C 'share-admin':58B,144C 'share-right':47B,66B,106C,153C,163C 'target':119C 'therefor':158C 'true':127C,131C 'under':213C 'user':34B,52B,123C 'uuid':69B,156C 'version':84C,224C 'without':167C,210C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Psono Server, in the Community Edition from `1.12.6` through `7.5.0` or the Enterprise Edition before `7.5.1`. Exposure needs an authenticated account that has been invited to a group with share-admin privileges and knowledge of a group share-right UUID. Installations on hosted Psono services or on `7.5.1` or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","passwordmanager","psono","selfhosted"],"campaign_type":null,"search_a":"'-128970':15A,18A '-2026':14A,17A 'cve':13A,16A 'group':4A,9A 'invite':5A 'pend':3A 'psono':1A 'revok':7A 'right':12A 'server':2A 'share':11A","search_b":"'accept':36B 'access':75B 'admin':60B 'allow':41B 'authent':51B 'check':31B 'delet':42B 'group':38B,45B,61B,73B 'host':26B 'invit':39B,55B 'know':64B 'manag':22B 'packag':19B 'password':21B 'password-manag':20B 'psono':23B,27B 'revok':71B 'right':49B,68B 'secret':79B 'self':25B 'self-host':24B 'server':28B 'share':48B,59B,67B,78B 'share-admin':58B 'share-right':47B,66B 'user':34B,52B 'uuid':69B","search_c":"'-10':232C '-13':233C '/share/right':111C '1.12.6':85C '2026':231C '7.5.0':87C '7.5.1':94C,225C 'accept':98C,130C,168C,178C,184C,207C 'access':196C 'admin':126C,146C,189C 'affect':199C 'attack':135C 'authent':122C,133C 'author':102C 'check':113C 'communiti':82C 'contain':203C 'content':218C 'data':214C 'declin':173C,181C 'delet':103C,110C,159C,191C,211C 'disclos':216C 'edit':83C,92C,228C 'endpoint':112C 'enterpris':91C 'fals':185C 'fix':222C 'flag':190C 'group':99C,105C,120C,142C,152C,161C,194C,208C 'invit':139C,170C,176C,182C 'issu':220C 'know':150C 'match':117C 'member':209C 'membership':100C,116C 'none':179C 'omit':129C 'pend':175C 'privileg':147C 'psono':80C,89C 'record':166C 'releas':229C 'remot':134C 'requir':97C 'retain':183C 'revok':192C 'right':108C,155C,165C 'secret':204C,217C 'server':81C,90C 'share':107C,125C,145C,154C,164C,188C,200C 'share-admin':144C 'share-right':106C,153C,163C 'target':119C 'therefor':158C 'true':127C,131C 'under':213C 'user':123C 'uuid':156C 'version':84C,224C 'without':167C,210C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"fdf66990-8419-4c8c-8848-ec15d75773b4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128970","severity":null,"published_at":"2026-11-13T15:17:45+00:00","modified_at":"2026-11-13T15:17:45+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","fetched_at":"2026-11-13T15:46:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}