CVE-2026-5652
Published: 21 April 2026
Summary
CVE-2026-5652 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Craftycontrol Crafty Controller. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-24 (Access Control Decisions).
Deeper analysis
CVE-2026-5652 is an insecure direct object reference (IDOR) vulnerability, mapped to CWE-639, in the Users API component of Crafty Controller. Published on 2026-04-21T17:16:57.793, it arises from improper API permissions validation, allowing unauthorized access to user modification actions. The vulnerability carries a CVSS v3.1 base score of 9.0 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L), indicating critical severity due to its network accessibility, low attack complexity, and significant impacts.
A remote, authenticated attacker with high privileges can exploit this flaw without user interaction. By leveraging the IDOR in the Users API, the attacker can perform unauthorized user modification actions, potentially compromising confidentiality and integrity of user data at a high level, with a low impact on availability, and scope crossing into changed components.
Advisories and further details, including potential patches, are documented in the Crafty Controller GitLab repository work item at https://gitlab.com/crafty-controller/crafty-4/-/work_items/705.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24199
Vulnerability details
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
IDOR in Users API enables exploitation of public-facing application (T1190) and unauthorized user modification consistent with account manipulation (T1098).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access, directly addressing the improper API permissions validation that enables IDOR-based unauthorized user modifications.
Requires access control decisions based on predefined criteria such as roles or attributes, mitigating flawed decisions in the Users API for specific object references.
Limits privileges to the minimum necessary, reducing the impact of high-privilege attackers exploiting IDOR to modify unauthorized user accounts.