CVE-2026-5652 - Vulnerability Analysis

Overview

Crafty Controller contains an insecure direct object reference caused by improper API permissions validation in the Users API component, letting remote authenticated attackers modify user data.

Severity & Score

Impact

Remote authenticated attackers can modify user data, potentially leading to unauthorized changes or privilege escalation.

Mitigation

Update to the latest version with proper API permissions validation.

References

• https://gitlab.com/crafty-controller/crafty-4/-/work_items/705

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 21, 2026

🔴 CVE-2026-5652 - Critical (9) An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5652/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner