CVE-2026-110130: fallo crítico en Finsys dockhand
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 10epss 0.7%
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Productos afectados
Finsys · dockhandCVEs relacionadas — Finsys dockhand
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-121448HIGHDockhand before 1.0.54 Path Traversal via Stack Environment RoutesEPSS 0.5%CVE-2026-53988CRITICALDockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook EndpointsEPSS 0.5%CVE-2026-121449HIGHDockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack WebhookEPSS 0.4%CVE-2026-110112CRITICALDockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim ValidationEPSS 0.4%CVE-2026-113354HIGHDockhand before 1.0.46 Arbitrary File Read via /api/system/files/contentEPSS 0.4%CVE-2026-110256MEDIUMDockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuthEPSS 0.4%