{"id":"CVE-2026-5251","state":"PUBLISHED","title":"z-9527 admin User Update Endpoint user.js dynamically-determined object attributes","description":"A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-04-01T02:30:14.392Z","updatedAt":"2026-04-01T13:12:46.568Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["z-9527 admin"],"affected":[{"vendor":"z-9527","product":"admin","versions":[{"version":"1.0","status":"affected"},{"version":"2.0","status":"affected"}],"modules":["User Update Endpoint"]}],"references":["https://vuldb.com/vuln/354441","https://vuldb.com/vuln/354441/cti","https://vuldb.com/submit/780607","https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-11"],"weaknesses":["CWE-915","CWE-913"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5251.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5251","state":"PUBLISHED","datePublished":"2026-04-01T02:30:14.392Z","dateUpdated":"2026-04-01T13:12:46.568Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-03-31T16:11:37.477Z"},"containers":{"cna":{"title":"z-9527 admin User Update Endpoint user.js dynamically-determined object attributes","descriptions":[{"lang":"en","value":"A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"z-9527","product":"admin","versions":[{"version":"1.0","status":"affected"},{"version":"2.0","status":"affected"}],"modules":["User Update Endpoint"]}],"references":[{"url":"https://vuldb.com/vuln/354441","name":"VDB-354441 | z-9527 admin User Update Endpoint user.js dynamically-determined object attributes","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354441/cti","name":"VDB-354441 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780607","name":"Submit #780607 | z-9527 admin ≤ commit 72aaf2d Dynamically-Determined Object Attributes","tags":["third-party-advisory"]},{"url":"https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-11","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-915","type":"CWE","lang":"en","description":"Dynamically-Determined Object Attributes"}]},{"descriptions":[{"cweId":"CWE-913","type":"CWE","lang":"en","description":"Dynamically-Managed Code Resources"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-04-01T02:30:14.392Z"},"timeline":[{"time":"2026-03-31T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-03-31T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-03-31T18:16:45.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"VulDB","type":"coordinator"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-01T13:12:39.257313Z","id":"CVE-2026-5251","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-01T13:12:46.568Z"}}]}}}