Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly with the API, these restrictions can be bypassed. By altering the path parameter in the delete request, internal OS files and directories can be removed successfully. The backend processes these manipulated requests without validating whether the targeted path belongs to restricted system locations. This demonstrates improper input validation and broken access control on sensitive filesystem operations. No known public patch is available.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-05 | 2 | Disclosure2 |
| 2026-03-07 | 2 | Disclosure1General1 |
| 2026-03-12 | 1 | Disclosure1 |
🔴 ZimaOS, Broken Access Control, #CVE-2026-28442 (High) https://dailycve.com/zimaos-broken-access-control-cve-2026-28442-high/
Post summary
The post announces a high‑severity broken access control flaw in ZimaOS (CVE‑2026‑28442) with minimal detail, no PoC or exploit supplied.
CVE-2026-28442 ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal sys… https://www.cve.org/CVERecord?id=CVE-2026-28442
Post summary
The text references CVE‑2026‑28442 but provides minimal details, lacking evidence of exploits, patches, or specific technical information.
🟠 CVE-2026-28442 - High ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders thro... https://www.thehackerwire.com/vulnerability/CVE-2026-28442/ https://t.co/iPy2Cia4UP
Post summary
CVE-2026-28442 is reported as high severity affecting ZimaOS 1.5.2-beta3, with an unspecified issue related to system file deletion, but no PoC, exploit details, or patch information are provided.
CVE-2026-28442 ZimaOS 1.5.2-beta3 Unauthorized File Deletion via API Path Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28442
Post summary
The text announces CVE‑2026‑28442, a ZimaOS 1.5.2‑beta3 vulnerability allowing unauthorized file deletion through API path manipulation, but it does not provide PoC, exploitation, or patch details.
[CVE-2026-28442: HIGH] ZimaOS, a fork of CasaOS, has a security flaw allowing users to bypass restrictions through API manipulation, raising concerns on access control and input validation.#cve,CVE-2026-28442,#cybersecurity https://cvefind.com/CVE-2026-28442
Post summary
The post announces a new high‑severity vulnerability in ZimaOS that lets attackers bypass access controls via API manipulation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | zimaspace | zimaos | 1.5.2 | - | - |