CVE-2026-35063
Missing Authorization in OpenPLC_V3
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
12th
OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete any other user, including administrators, by specifying their user ID or they can create new accounts with role=admin, escalating to full administrator access.
| CWE | CWE-862 |
| Vendor | openplc_v3 |
| Product | openplc_v3 |
| Published | Apr 9, 2026 |
| Last Updated | Apr 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for openplc_v3 openplc_v3
Be the first to know when new unknown vulnerabilities affecting openplc_v3 openplc_v3 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
OpenPLC_V3 / OpenPLC_V3
All versions
References
Credits
Arad Inbar, Nir Somech, Ben Grinberg, Daniel Lubel, Erez Cohen, and Adiel Sol from DREAM