CVE-2026-117472— URL prefix handling permits API key read-scope bypass in Psono Server

Quick assessment

Affected

esaqa GmbH Psono

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Psono Server CE 和 EE 版本 4.0.33 至 7.2.3 在批量秘密读取（bulk-secret-read）端点中，将请求路径与一个硬编码的、未添加前缀的路径进行了比较。在配置了 URL_PREFIX 的部署环境中，该比较会失败，导致 POST 请求错误地使用了写权限（write scope）而非读权限（read scope）进行授权。因此，拥有非常规的“禁用读取、启用写入”API 密钥的已认证远程攻击者，即使不具备读取权限，仍可通过带前缀的批量秘密读取端点获取加密的秘密数据及随机数（nonce

CVSS 4.3 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1548.001 · Setuid and Setgid T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

URL prefix handling permits API key read-scope bypass in Psono Server

Source: CVE Program / CVE List V5

Vulnerability Description

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
esaqa GmbH	Psono	4.0.33 ~ 7.2.4	-

II. Public POCs for CVE-2026-117472

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117472

请登录查看更多情报信息。

Other References for CVE-2026-117472 (5)

https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/permissions.py technical-description
https://gitlab.com/esaqa/psono/psono-server/-/commit/5638d4be806af7d1dea03f7cad3927aa2bd19cf4 patch
https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4 release-notes
https://gitlab.com/esaqa/psono/psono-server product
https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117472.md vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-117472

Same Patch Batch · esaqa GmbH · 2026-10-27 · 5 CVEs total

CVE-2026-117468	6.5 MEDIUM	Device-code claim permits restricted token escalation in Psono Server
CVE-2026-117470	6.5 MEDIUM	WebAuthn assertion replay permits second-factor bypass in Psono Server
CVE-2026-117471	5.4 MEDIUM	User-controlled Duo host permits authenticated SSRF in Psono Server
CVE-2026-117469	5.4 MEDIUM	File-transfer type confusion permits unauthorized repository writes in Psono Server

IV. Related Vulnerabilities

Same product: Psono

Same vendor: esaqa GmbH

Same weakness: CWE-863