CVE-2026-129110

CRITICAL 9.8

sysPass 3.0.1 through 3.2.11 Unauthenticated Reinstallation RCE via install/install

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite config.xml, point the application at an attacker-controlled database, create an administrator account, and plant serialized PublicLink gadget chains triggered via account/viewLink to execute commands.

CWE	CWE-306
Vendor	nuxsmin
Product	syspass
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for nuxsmin syspass

Be the first to know when new critical vulnerabilities affecting nuxsmin syspass are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

nuxsmin / sysPass

3.0.1 ≤ 3.2.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nuxsmin/sysPass/blob/3.2.11/app/modules/web/Controllers/InstallController.php#L80-L110 github.com: https://github.com/OpusProjects/sysPass/pull/360 github.com: https://github.com/nuxsmin/sysPass/issues/1954 github.com: https://github.com/nuxsmin/sysPass vulncheck.com: https://www.vulncheck.com/advisories/syspass-3.0.1-through-3.2.11-unauthenticated-reinstallation-rce-via-install-install

Credits

r3verii (Martino Spagnuolo) Marcos Azevedo (psylinux)