Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Pachno 1.0.6 contains an authentication bypass vulnerability in the runSwitchUser() action that allows authenticated low-privilege users to escalate privileges by manipulating the original_username cookie. Attackers can set the client-controlled original_username cookie to any value and request a switch to user ID 1 to obtain session tokens or password hashes belonging to administrator accounts.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨*CVE* CVE-2026-40043 Pachno 1.0.6 contains an authentication bypass vulnerability in the runSwitchUser() action that allows authenticated low-privilege users to escalate privileges by man… https://www.cve.org/CVERecord?id=CVE-2026-40043 ----- Traducción: CVE-2026-40043 Pachno 1.0.6 contiene una vu…
Post summary
The tweet announces CVE-2026-40043, a Pachno 1.0.6 authentication bypass that enables privilege escalation.
CVE-2026-40043 Pachno 1.0.6 contains an authentication bypass vulnerability in the runSwitchUser() action that allows authenticated low-privilege users to escalate privileges by man… https://www.cve.org/CVERecord?id=CVE-2026-40043
Post summary
The post announces an authentication bypass in Pachno 1.0.6 that enables privilege escalation for low-privilege users, but includes no PoC, exploit code, patch, or evidence of active exploitation.