VulnSocial

CVE-2026-85638General

LOWCVSS 5.5 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-285CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-04); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-04: 1Mentions · 2026-09-09: 1PoC Mentioned / Linked · 2026-09-09: 1Exploit Tool / Code · 2026-09-09: 1Technical Details · 2026-09-09: 109-0409-09
Signal classification2 categories
General
150.0%
Exploit
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-041
General1
2026-09-091
Exploit1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Exploit

    CVE-2026-85638: Trape 2.0 authorization bypass in core/user.py via vId/id. Public exploit, unpatched—remote attacks likely. CVSS 7.3 high. No vendor response yet. Audit Trape deployments now. Details: https://www.valtersit.com/cve/CVE-2026-85638 #valtersit #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #china #france #germany #docker #kali

    Post summary

    CVE-2026-85638 is an authorization bypass in Trape 2.0 with a publicly available exploit; no patch exists and immediate deployment audits are advised.

    0000050
    1.0K followersView on X
  • CVE@CVEnew
    General

    CVE-2026-85638 A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorizati… https://www.cve.org/CVERecord?id=CVE-2026-85638

    Post summary

    The post merely announces a weakness in jofpin trape 2.0 that could affect authorization via an argument manipulation; no further technical details, exploits, or mitigations are provided.

    00000928
    58.1K followersView on X

Explore more

Back to dashboard