CVE-2026-76876

MEDIUM 5.9

Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.

CWE	CWE-862
Vendor	puemos
Product	craftplan
Published	Aug 21, 2026

Stay Ahead of the Next One

Get instant alerts for puemos craftplan

Be the first to know when new medium vulnerabilities affecting puemos craftplan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

puemos / craftplan

0 < 0.5.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/puemos/craftplan/releases/tag/v0.5.1 github.com: https://github.com/puemos/craftplan/commit/317acd584b68887f592dc3b97f47703dd63b1bf vulncheck.com: https://www.vulncheck.com/advisories/craftplan-broken-access-control-information-disclosure-via-settings-api

Credits

Michael Holmquist