CVE-2026-6570
Full vulnerability record from the local CVENow database.
Description
A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php. Performing a manipulation of the argument path results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
LOW
CVSS score
2.0
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-04-19 12:16:32.763000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-6570",
"sourceIdentifier": "[email protected]",
"published": "2026-04-19T12:16:32.763",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php. Performing a manipulation of the argument path results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "es",
"value": "Se ha descubierto una falla de seguridad en kodcloud KodExplorer hasta 4.52. Afectada es la función initInstall del archivo /app/controller/systemMember.class.php. Realizar una manipulación del argumento path resulta en omisión de autorización. El ataque puede ser iniciado remotamente. El exploit ha sido publicado al público y puede ser usado para ataques. El proveedor fue contactado tempranamente sobre esta divulgación pero no respondió de ninguna manera."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "kodcloud",
"product": "KodExplorer",
"cpes": [
"cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "4.0",
"status": "affected"
},
{
"version": "4.1",
"status": "affected"
},
{
"version": "4.2",
"status": "affected"
},
{
"version": "4.3",
"status": "affected"
},
{
"version": "4.4",
"status": "affected"
},
{
"version": "4.5",
"status": "affected"
},
{
"version": "4.6",
"status": "affected"
},
{
"version": "4.7",
"status": "affected"
},
{
"version": "4.8",
"status": "affected"
},
{
"version": "4.9",
"status": "affected"
},
{
"version": "4.10",
"status": "affected"
},
{
"version": "4.11",
"status": "affected"
},
{
"version": "4.12",
"status": "affected"
},
{
"version": "4.13",
"status": "affected"
},
{
"version": "4.14",
"status": "affected"
},
{
"version": "4.15",
"status": "affected"
},
{
"version": "4.16",
"status": "affected"
},
{
"version": "4.17",
"status": "affected"
},
{
"version": "4.18",
"status": "affected"
},
{
"version": "4.19",
"status": "affected"
},
{
"version": "4.20",
"status": "affected"
},
{
"version": "4.21",
"status": "affected"
},
{
"version": "4.22",
"status": "affected"
},
{
"version": "4.23",
"status": "affected"
},
{
"version": "4.24",
"status": "affected"
},
{
"version": "4.25",
"status": "affected"
},
{
"version": "4.26",
"status": "affected"
},
{
"version": "4.27",
"status": "affected"
},
{
"version": "4.28",
"status": "affected"
},
{
"version": "4.29",
"status": "affected"
},
{
"version": "4.30",
"status": "affected"
},
{
"version": "4.31",
"status": "affected"
},
{
"version": "4.32",
"status": "affected"
},
{
"version": "4.33",
"status": "affected"
},
{
"version": "4.34",
"status": "affected"
},
{
"version": "4.35",
"status": "affected"
},
{
"version": "4.36",
"status": "affected"
},
{
"version": "4.37",
"status": "affected"
},
{
"version": "4.38",
"status": "affected"
},
{
"version": "4.39",
"status": "affected"
},
{
"version": "4.40",
"status": "affected"
},
{
"version": "4.41",
"status": "affected"
},
{
"version": "4.42",
"status": "affected"
},
{
"version": "4.43",
"status": "affected"
},
{
"version": "4.44",
"status": "affected"
},
{
"version": "4.45",
"status": "affected"
},
{
"version": "4.46",
"status": "affected"
},
{
"version": "4.47",
"status": "affected"
},
{
"version": "4.48",
"status": "affected"
},
{
"version": "4.49",
"status": "affected"
},
{
"version": "4.50",
"status": "affected"
},
{
"version": "4.51",
"status": "affected"
},
{
"version": "4.52",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.0,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 2.7,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.2,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N",
"baseScore": 3.3,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "MULTIPLE",
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"availabilityImpact": "NONE"
},
"baseSeverity": "LOW",
"exploitabilityScore": 6.4,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-20T16:23:35.480939Z",
"id": "CVE-2026-6570",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-285"
},
{
"lang": "en",
"value": "CWE-639"
}
]
}
],
"references": [
{
"url": "https://vuldb.com/submit/789983",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/358204",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/358204/cti",
"source": "[email protected]"
},
{
"url": "https://vulnplus-note.wetolink.com/share/byd7AQVs42VY",
"source": "[email protected]"
}
]
}