payload-ng non-admin SETTINGS user bypass disabling outbound TLS peer verification (Incomplete Fix for CVE-2026-33509)

Vulnerability Overview Vulnerability Name: payload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted 'ssl_verify' config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586) Vulnerability Description: In the method within , the decorator restricts modifications to security options. However, the and options in the list were not included. Any user with permission but without admin privileges can set to , thereby disabling certificate verification for all outbound TLS requests. An attacker can exploit this vulnerability to perform man-in-the-middle attacks using forged certificates. Impact Scope Affected Versions: Fixed Version: CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVSS v3 Score: 6.8 / 10 Remediation Fixed Version: Fix Details: The and options have been added to the list, ensuring that only administrators can modify these options. POC Code Verification Observe the behavior of in debug builds, or verify success and failure cases when downloading from HTTPS endpoints using self-signed or mismatched certificates. Impact Who: Any user with permission but without admin privileges. What: - Man-in-the-middle attacks in all HTTPS downloads, CAPTCHA fetching, update checks, and plugin HTTP calls. - Expanded impact on known SSRF chains (CVE-2026-33502 / CVE-2026-35455). - Bypasses hostname verification for validated endpoints, leading to the acceptance of forged certificates for validated endpoints. - Unrestricted access to sensitive options such as , , and . Not Affected: Unauthenticated attackers; users holding only or permissions.

Goal Reached Thanks to every supporter — we hit 100%!

payload-ng non-admin SETTINGS user bypass disabling outbound TLS peer verification (Incomplete Fix for CVE-2026-33509)

More from this source