Cyber Resilience

CVE-2026-15617

Published
23 July 2026
Modified
27 July 2026
CVSS Score v3.1 9.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0028 20th percentile
Risk Priority 66 floored blend · peak EPSS

Summary

CVE-2026-15617 is a critical-severity Improper Handling of Case Sensitivity (CWE-178) vulnerability. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.

CWE(s)
CWE-178

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-6866Shared CWE-178
CVE-2024-38829Shared CWE-178
CVE-2026-33691Shared CWE-178
CVE-2025-27636Shared CWE-178
CVE-2024-5699Shared CWE-178
CVE-2026-29054Shared CWE-178
CVE-2026-8404Shared CWE-178
CVE-2026-48595Shared CWE-178
CVE-2023-3545Shared CWE-178
CVE-2026-15573Shared CWE-178

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-24 Access Control Decisions partial match

Applying access control decisions to each request depends on accurate property determination that accounts for case differences.

AC-3 Access Enforcement partial match

Correct enforcement of authorizations for resource access structurally requires consistent case-sensitive handling of identifiers to avoid incorrect decisions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
prevents

Secure SDLC practices can catch and prevent case-sensitivity flaws during code review or testing, but fixing one CWE achieves negligible coverage of the broad control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC practices should include case-sensitivity requirements in design and coding standards.

A.8.26 Application security requirements partial match
prevents

Application security requirements must specify case handling for identifiers and paths.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Architecture principles should enforce canonical, case-aware resource naming.

A.8.28 Secure coding partial match
prevents

Secure coding guidelines must mandate explicit case handling to prevent inconsistent lookups.

A.8.3 Information access restriction partial match
degrades

Access-control rules that ignore case can allow unintended resource access.

A.8.5 Secure authentication partial match
degrades

Authentication logic must treat identifiers consistently to avoid bypass via case differences.

References