CVE-2026-44196

{
  "id": "CVE-2026-44196",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T18:17:29.730",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3."
    },
    {
      "lang": "es",
      "value": "Pingvin Share X es una plataforma segura y sencilla de autoalojamiento para compartir archivos. Desde la versión 1.14.1 hasta la 1.16.2, una vulnerabilidad crítica de omisión de autenticación permite a un atacante que ha obtenido un nombre de usuario y una contraseña válidos omitir completamente el requisito de autenticación de segundo factor (TOTP). Aunque, un atacante aún necesita la contraseña del usuario para alcanzar esta etapa. Esta vulnerabilidad está corregida en la versión 1.16.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "smp46",
          "product": "pingvin-share-x",
          "versions": [
            {
              "version": ">= 1.14.1, < 1.16.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T19:48:14.609120Z",
          "id": "CVE-2026-44196",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-697"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-j679-vp39-qwqq",
      "source": "[email protected]"
    }
  ]
}