{"id":"CVE-2026-5749","state":"PUBLISHED","title":"Inadequate access control vulnerability in Fullstep","description":"Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain a valid JWT token with which to interact with authenticated API resources. Successful exploitation of this vulnerability could allow an unauthenticated attacker to compromise the confidentiality of the affected resource, provided they have a valid token with which to interact with the API.","publishedAt":"2026-04-22T13:23:37.971Z","updatedAt":"2026-04-22T14:06:57.793Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"INCIBE"},"assigner":"INCIBE","products":["Fullstep Fullstep"],"affected":[{"vendor":"Fullstep","product":"Fullstep","defaultStatus":"unaffected","versions":[{"version":"5","status":"affected"},{"version":"5.30.07","status":"unaffected"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fullstep"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5749.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5749","state":"PUBLISHED","datePublished":"2026-04-22T13:23:37.971Z","dateUpdated":"2026-04-22T14:06:57.793Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2026-04-07T15:31:14.737Z"},"containers":{"cna":{"title":"Inadequate access control vulnerability in Fullstep","descriptions":[{"lang":"en","value":"Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain a valid JWT token with which to interact with authenticated API resources. Successful exploitation of this vulnerability could allow an unauthenticated attacker to compromise the confidentiality of the affected resource, provided they have a valid token with which to interact with the API."}],"affected":[{"vendor":"Fullstep","product":"Fullstep","defaultStatus":"unaffected","versions":[{"version":"5","status":"affected"},{"version":"5.30.07","status":"unaffected"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fullstep","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"CWE-306 Missing authentication for critical function","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2026-04-22T13:24:06.620Z"},"datePublic":"2026-04-20T10:00:00.000Z","cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fullstep:fullstep:5:*:*:*:*:*:*:*"},{"vulnerable":false,"criteria":"cpe:2.3:a:fullstep:fullstep:5.30.07:*:*:*:*:*:*:*"}]}]}],"solutions":[{"lang":"en","value":"The vulnerability has been fixed by the Fullstep team in version 5.30.07, which has been available in production since January 29, 2026.","supportingMedia":[{"type":"text/html","base64":false,"value":"The vulnerability has been fixed by the Fullstep team in version 5.30.07, which has been available in production since January 29, 2026."}]}],"credits":[{"lang":"en","value":"Alejandro Rivera León","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-22T14:02:34.571025Z","id":"CVE-2026-5749","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-22T14:06:57.793Z"}}]}}}