Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-5652 An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification a… https://www.cve.org/CVERecord?id=CVE-2026-5652
Post summary
The text announces an IDOR vulnerability (CVE‑2026‑5652) in Crafty Controller’s Users API that permits an authenticated, remote attacker to modify user data.
🚨 CVE-2026-5652: Authorization Bypass Through User... IDOR in Crafty's Users API lets any authenticated user escalate to admin by manipulating user IDs - classic horizontal p... https://zerodaysignal.com/vulnerability/CVE-2026-5652 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE-2026-5652 discloses an IDOR vulnerability in Crafty's Users API that lets authenticated users elevate privileges to admin by manipulating user IDs.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | craftycontrol | crafty_controller | - | - | - |