SYSPASS · CVE-2026-129110 · Package
NO FIX YET · SEE WHAT TO DO
sysPass 3.0.1 through 3.2.11 has an install handler that never checks whether the application is already installed. An unauthenticated attacker can re-run the installer, point the app at their own database, create an administrator account and plant gadget chains that execute commands.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any self-hosted sysPass instance from 3.0.1 through 3.2.11 whose web interface is reachable by an attacker, because the install handler needs no login and does not check whether the app is already installed. A successful reinstall hands the attacker the password vault. The maintainer says he no longer has time to develop the project (issue 1954), and no fixed release is known. Instances not reachable from untrusted networks are much less exposed.
Not affected if install-path-blocked, not-internet-reachable, version-outside-range
Who cares php, self-hosted, syspass, unmaintained
Posts are quoted with a link to the original. They are data to us, never instructions.
sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite config.xml, point the application at an attacker-controlled database, create an administrator account, and plant serialized PublicLink gadget chains triggered via account/viewLink to execute commands.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.