{"id":"CVE-2026-129110","kind":"vulnerability","aliases":["CVE-2026-129110"],"related":[],"title":"sysPass: unauthenticated reinstall lets attackers take over the password manager","description":"sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite config.xml, point the application at an attacker-controlled database, create an administrator account, and plant serialized PublicLink gadget chains triggered via account/viewLink to execute commands.","summary":"sysPass 3.0.1 through 3.2.11 has an install handler that never checks whether the application is already installed. An unauthenticated attacker can re-run the installer, point the app at their own database, create an administrator account and plant gadget chains that execute commands.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sysPass","fixed":[],"affected":">= 3.0.1, <= 3.2.11","ecosystem":"composer"}],"ecosystems":[],"tags":["package","php","self-hosted","syspass","unmaintained"],"not_affected_if":["install-path-blocked","not-internet-reachable","version-outside-range"],"how_to_check":"- Find the sysPass version (admin UI footer or the app's version constant). 3.0.1 to 3.2.11 is affected; 3.2.11 is the latest upstream release and no fixed version is known.\n- Test whether the installer answers on a running instance: curl -I https://<host>/index.php?r=install/install. Per the VulnCheck advisory, the handler (InstallController.php, lines 80-110 at tag 3.2.11) never checks isInstalled(). Do not POST to a production instance.\n- Check for a changed config.xml, unknown admin accounts, or a database host you do not recognise.","fix":"No fixed version is known. Vendor/maintainer pages name none; the maintainer said in issue 1954 he no longer maintains sysPass. Workaround: block /index.php?r=install/* (or the install route) at the web server or reverse proxy, restrict the app to a VPN or allowlist, make config.xml read-only, and plan a move to another password manager or a maintained fork (unreviewed).","status":"open","published_at":"2026-11-13T16:19:00+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","triaged_at":"2026-11-13T16:48:11+00:00","updated_at":"2026-11-13T16:49:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T16:48:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"sysPass: unauthenticated reinstall lets attackers take over the password manager","impact":"high","summary":"sysPass 3.0.1 through 3.2.11 has an install handler that never checks whether the application is already installed. An unauthenticated attacker can re-run the installer, point the app at their own database, create an administrator account and plant gadget chains that execute commands.","audience":"businesses","category":"package","nicknames":[],"who_cares":["sysPass","self-hosted","php"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gains administrator access and executes commands on the server","analyst_note":"Confirm the fixed version and any vendor advisory; the sources only cite NVD and a VulnCheck third-party advisory.","how_to_check":"- Check the installed sysPass version in the application's configuration or admin interface.\n- Look for `install/install` reachable on the running instance, for example with `curl -I https://<host>/install/install`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Any sysPass instance in the affected version range that is reachable from the network is exposed, since the installer endpoint does not require authentication. Instances behind strict network restrictions or with the install path blocked are less exposed. The sources do not state which configurations are safe.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000722,"input_tokens":4631,"output_tokens":517,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor advisory; the sources only cite NVD and a VulnCheck third-party advisory.","search":"'-129110':13A,16A '-2026':12A,15A '3.0.1':26B,70C '3.2.11':28B,72C 'account':61B,115C 'account/viewlink':124C 'administr':60B,114C 'allow':79C 'alreadi':40B,86C 'already-instal':85C 'app':53B 'applic':38B,105C 'attack':5A,44B,81C,99C,109C 'attacker-control':108C 'authent':75C 'bypass':76C 'chain':65B,121C 'check':35B,97C 'command':68B,127C 'config.xml':102C 'contain':73C 'control':110C 'creat':58B,112C 'cve':11A,14A 'databas':57B,111C 'execut':67B,126C 'gadget':64B,120C 'handler':32B,94C 'host':22B 'instal':31B,41B,50B,87C 'install/install':93C 'instanc':88C 'isinstal':98C 'let':4A 'manag':10A 'never':34B,96C 'overwrit':101C 'packag':18B 'password':9A 'php':19B 'plant':63B,117C 'point':51B,103C 'post':90C 'publiclink':119C 're':47B 're-run':46B 'reinstal':3A,83C 'run':48B 'self':21B 'self-host':20B 'serial':118C 'syspass':1A,17A,23B,25B,69C 'take':6A 'trigger':122C 'unauthent':2A,43B,80C 'unmaintain':24B 'via':123C 'vulner':77C 'whether':36B","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted sysPass instance from 3.0.1 through 3.2.11 whose web interface is reachable by an attacker, because the install handler needs no login and does not check whether the app is already installed. A successful reinstall hands the attacker the password vault. The maintainer says he no longer has time to develop the project (issue 1954), and no fixed release is known. Instances not reachable from untrusted networks are much less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["syspass"],"ptokens":["syspass"],"labels":["critical","package","php","selfhosted","syspass","unmaintained"],"campaign_type":null,"search_a":"'-129110':13A,16A '-2026':12A,15A 'attack':5A 'cve':11A,14A 'let':4A 'manag':10A 'password':9A 'reinstal':3A 'syspass':1A,17A 'take':6A 'unauthent':2A","search_b":"'3.0.1':26B '3.2.11':28B 'account':61B 'administr':60B 'alreadi':40B 'app':53B 'applic':38B 'attack':44B 'chain':65B 'check':35B 'command':68B 'creat':58B 'databas':57B 'execut':67B 'gadget':64B 'handler':32B 'host':22B 'instal':31B,41B,50B 'never':34B 'packag':18B 'php':19B 'plant':63B 'point':51B 're':47B 're-run':46B 'run':48B 'self':21B 'self-host':20B 'syspass':23B,25B 'unauthent':43B 'unmaintain':24B 'whether':36B","search_c":"'3.0.1':70C '3.2.11':72C 'account':115C 'account/viewlink':124C 'administr':114C 'allow':79C 'alreadi':86C 'already-instal':85C 'applic':105C 'attack':81C,99C,109C 'attacker-control':108C 'authent':75C 'bypass':76C 'chain':121C 'check':97C 'command':127C 'config.xml':102C 'contain':73C 'control':110C 'creat':112C 'databas':111C 'execut':126C 'gadget':120C 'handler':94C 'instal':87C 'install/install':93C 'instanc':88C 'isinstal':98C 'never':96C 'overwrit':101C 'plant':117C 'point':103C 'post':90C 'publiclink':119C 'reinstal':83C 'serial':118C 'syspass':69C 'trigger':122C 'unauthent':80C 'via':123C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:19:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129110","severity":null,"published_at":"2026-11-13T16:19:00+00:00","modified_at":"2026-11-13T16:19:00+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","fetched_at":"2026-11-13T16:47:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129110:3904","url":null,"severity":null,"published_at":"2026-11-13T16:49:26+00:00","modified_at":"2026-11-13T16:49:26+00:00","first_seen_at":"2026-11-13T16:49:26+00:00","fetched_at":"2026-11-13T16:49:26+00:00","note":"NVD and VulnCheck only; no vendor advisory exists (GitHub shows none). Issue 1954 shows the project abandoned. Nothing marked verified: no fix or primary words read. No exploitation or PoC found. web-cli was not available as a tool; X not checked."}],"documents":[{"id":147664,"url":"https://www.vulncheck.com/advisories/syspass-3.0.1-through-3.2.11-unauthenticated-reinstallation-rce-via-install-install","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":147677,"url":"https://github.com/nuxsmin/sysPass/issues/1954","title":"sysPass issue 1954: maintainer says project no longer maintained","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}