---
id: "CVE-2026-128970"
page: "https://infrastack.ai/live/CVE-2026-128970"
kind: "vulnerability"
aliases: ["CVE-2026-128970"]
title: "Psono Server: pending group invitee can revoke a group's share rights"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "password-manager", "psono", "self-hosted"]
not_affected_if: ["managed-hosting", "no-group-shares", "version-7.5.1-or-later"]
published_at: "2026-11-13T15:17:45+00:00"
first_seen_at: "2026-11-13T15:46:19+00:00"
updated_at: "2026-11-13T15:48:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128970", "first_seen_at": "2026-11-13T15:46:19+00:00"}]
exploit_sources: []
---

# Psono Server: pending group invitee can revoke a group's share rights

Link for people: https://infrastack.ai/live/CVE-2026-128970 (this .md is for agents)

Psono Server does not check that a user has accepted a group invitation before allowing deletion of that group's share-rights. An authenticated user who was invited to a share-admin group, and who knows a share-right UUID, can revoke the group's access to a shared secret.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Psono Server version: `7.5.0` or earlier in the Community Edition (from `1.12.6`) or any Enterprise Edition before `7.5.1` is affected.
- Confirm whether untrusted or newly invited accounts can reach the server's `DELETE /share/right/` endpoint.

## Fix

- Psono Server Community Edition and Enterprise Edition: move to `7.5.1`.

## Timeline

- 2026-11-13T15:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128970

## From the sources

Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the authenticated user, and share_admin=True, but omits accepted=True. An authenticated remote attacker who has been invited to a group with share-admin privileges, and who knows a group share-right UUID, can therefore delete that group's share-right record without accepting the invitation or after declining it. Pending invitations have accepted=None, while declined invitations retain accepted=False and the share_admin flag. Deletion revokes the group's access to the affected share and its contained secrets for all accepted group members, without deleting the underlying data or disclosing secret contents. The issue was fixed in version 7.5.1 of both editions, released on 2026-10-13.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_