CVE-2026-5652CWE-639

Authorization Bypass Through User-Controlled Key in Crafty Controller

Critical · published April 21, 2026

CVSS v3.1
9.0
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00513 · 42.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-21T16:33Z
EPSS history
Timeline
  • 21 APR 16:33Z
    Authorization Bypass Through User-Controlled Key in Crafty Controller
    cvelistv5