An authorization bypass vulnerability in sysPass allows authenticated users to gain unauthorized access to sensitive account data.

The application suffers from an Insecure Direct Object Reference (IDOR) issue, categorized as CWE-639, where user-controlled keys are not properly validated during account access. This requires the attacker to be an authenticated user to leverage the flaw.

With a CVSS score of 8.1, this vulnerability represents a severe risk to data confidentiality and integrity. Authenticated attackers can potentially access or modify sensitive account information belonging to other users by manipulating object keys. This could lead to a significant breach of sensitive credentials stored within the sysPass vault, resulting in broad organizational exposure.

Immediate Action: Review vendor security advisories for a patched release and update sysPass immediately upon availability.

Proactive Monitoring: Review application access logs for anomalous activity, specifically looking for users attempting to access account IDs that do not correlate with their assigned permissions.

Compensating Controls: Implement strict access control lists and, where possible, restrict access to the account management module to only authorized administrative users while a patch is pending.

Public Exploit Available: No (unknown)

The risk of unauthorized access to credential stores is extreme. Organizations should immediately audit their sysPass instances for suspicious access patterns and prepare to apply the vendor-provided security update as soon as it is released to close this authorization gap.