CVE-2026-59255CWE-862broken-access-control

CVE-2026-59255

High · published July 15, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00439 · 37.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-15T22:16Z
References (4)
https://github.com/SpecterOps/BloodHound/commit/8f790351349fd87bcb04377aba84cba6495825b3 · [email protected]https://github.com/SpecterOps/BloodHound/issues/2910 · [email protected]https://github.com/SpecterOps/BloodHound/pull/2989 · [email protected]https://www.vulncheck.com/advisories/bloodhound-missing-authorization-on-custom-node-management-api · [email protected]
EPSS history
Timeline
  • 15 JUL 17:03Z
    BloodHound Missing Authorization on Custom Node Management API
    cvelistv5