---
id: "CVE-2026-129110"
page: "https://infrastack.ai/live/CVE-2026-129110"
kind: "vulnerability"
aliases: ["CVE-2026-129110"]
title: "sysPass: unauthenticated reinstall lets attackers take over the password manager"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "sysPass", "fixed": [], "affected": ">= 3.0.1, <= 3.2.11", "ecosystem": "composer"}]
ecosystems: []
tags: ["package", "php", "self-hosted", "syspass", "unmaintained"]
not_affected_if: ["install-path-blocked", "not-internet-reachable", "version-outside-range"]
published_at: "2026-11-13T16:19:00+00:00"
first_seen_at: "2026-11-13T16:47:34+00:00"
updated_at: "2026-11-13T16:49:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129110", "first_seen_at": "2026-11-13T16:47:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T16:49:26+00:00"}]
exploit_sources: []
---

# sysPass: unauthenticated reinstall lets attackers take over the password manager

Link for people: https://infrastack.ai/live/CVE-2026-129110 (this .md is for agents)

sysPass 3.0.1 through 3.2.11 has an install handler that never checks whether the application is already installed. An unauthenticated attacker can re-run the installer, point the app at their own database, create an administrator account and plant gadget chains that execute commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:sysPass affected >= 3.0.1, <= 3.2.11 fixed no fixed version listed

## How to check

- Find the sysPass version (admin UI footer or the app's version constant). 3.0.1 to 3.2.11 is affected; 3.2.11 is the latest upstream release and no fixed version is known.
- Test whether the installer answers on a running instance: curl -I https://<host>/index.php?r=install/install. Per the VulnCheck advisory, the handler (InstallController.php, lines 80-110 at tag 3.2.11) never checks isInstalled(). Do not POST to a production instance.
- Check for a changed config.xml, unknown admin accounts, or a database host you do not recognise.

## Fix

No fixed version is known. Vendor/maintainer pages name none; the maintainer said in issue 1954 he no longer maintains sysPass. Workaround: block /index.php?r=install/* (or the install route) at the web server or reverse proxy, restrict the app to a VPN or allowlist, make config.xml read-only, and plan a move to another password manager or a maintained fork (unreviewed).

## Timeline

- 2026-11-13T16:47:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129110
- 2026-11-13T16:49:26+00:00 analyst — NVD and VulnCheck only; no vendor advisory exists (GitHub shows none). Issue 1954 shows the project abandoned. Nothing marked verified: no fix or primary words read. No exploitation or PoC found. web-cli was not available as a tool; X not checked.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/syspass-3.0.1-through-3.2.11-unauthenticated-reinstallation-rce-via-install-install
- [discussion] sysPass issue 1954: maintainer says project no longer maintained https://github.com/nuxsmin/sysPass/issues/1954

## From the sources

sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite config.xml, point the application at an attacker-controlled database, create an administrator account, and plant serialized PublicLink gadget chains triggered via account/viewLink to execute commands.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_