CVE-2026-17038CWE-798hardcoded-credentials

CVE-2026-17038

published September 10, 2026

CVSS
6.9
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00264 · 17.4th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-09-10T17:17Z
References (2)
https://cert.pl/posts/2026/09/CVE-2026-17038 · [email protected]https://dreryk.pl/produkty/gabinet/ · [email protected]
EPSS history
Timeline
  • 12 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 10 SEP 12:02Z
    Use of Hard-coded Credentials in drEryk Gabinet
    cvelistv5