← Back to CVE Explorer

CVE-2026-40550

Full vulnerability record from the local CVENow database.

Description

Multiple BinSoft products are vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application’s memory by inspecting the running process. While ability to retrieve credentials from memory is the expected behavior, the exposed credentials grant administrative access to the database, exceeding the privileges required for normal application functionality. This allows an attacker to perform actions beyond those permitted through the application interface. The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.

Severity
MEDIUM
CVSS score
6.9 (v4.0)
Vulnerability status
Deferred
Source identifier
[email protected]
Published
2026-04-28 14:16:13.337000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON 
{
  "id": "CVE-2026-40550",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-28T14:16:13.337",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple BinSoft products are vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application’s memory by inspecting the running process. While ability to retrieve credentials from memory is the expected behavior, the exposed credentials grant administrative access to the database, exceeding the privileges required for normal application functionality. This allows an attacker to perform actions beyond those permitted through the application interface.\n\nThe described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual."
    },
    {
      "lang": "es",
      "value": "Múltiples productos BinSoft son vulnerables a la escalada de privilegios debido a los privilegios excesivos de base de datos asignados al usuario utilizado por la aplicación. Un atacante con acceso a cualquier instancia de aplicación en ejecución conectada al servidor de backend puede extraer credenciales de la base de datos de la memoria de la aplicación inspeccionando el proceso en ejecución. Si bien la capacidad de recuperar credenciales de la memoria es el comportamiento esperado, las credenciales expuestas otorgan acceso administrativo a la base de datos, excediendo los privilegios requeridos para la funcionalidad normal de la aplicación. Esto permite a un atacante realizar acciones más allá de las permitidas a través de la interfaz de la aplicación.\n\nEl problema descrito afecta a todas las versiones publicadas. El proveedor declaró que este problema es un resultado directo del modelo de arquitectura en el que se distribuye el software, y que se mitigará con un manual de instalación corregido."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "BinSoft",
          "product": "mpGabinet",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "23.12.19",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "BinSoft",
          "product": "mpFirma",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "26.4.9",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "BinSoft",
          "product": "mpFaktura",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "26.4.9",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "BinSoft",
          "product": "mpFirma ERP",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "26.4.9",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "BinSoft",
          "product": "mpSekretariat",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "25.2.4",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "BinSoft",
          "product": "mpPOS",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "25.2.4",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "BinSoft",
          "product": "mpCRM",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "25.2.4",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "BinSoft",
          "product": "mpWarsztat",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "20.4.28",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-28T14:15:28.325986Z",
          "id": "CVE-2026-40550",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cert.pl/posts/2026/04/CVE-2026-40550/",
      "source": "[email protected]"
    },
    {
      "url": "https://www.binsoft.pl/produkty",
      "source": "[email protected]"
    }
  ]
}