{"id":"CVE-2026-117472","title":"URL prefix handling permits API key read-scope bypass in Psono Server","summary":"Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-863"],"vendor":"esaqa GmbH","product":"Psono","affected":["Psono >= 4.0.33 < 7.2.4"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T05:56:16.775Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117472","references":[{"url":"https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117472.md","label":"Vendor security advisory for CVE-2026-117472"},{"url":"https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/permissions.py"},{"url":"https://gitlab.com/esaqa/psono/psono-server/-/commit/5638d4be806af7d1dea03f7cad3927aa2bd19cf4"},{"url":"https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"},{"url":"https://gitlab.com/esaqa/psono/psono-server"}],"tags":["cve.org"],"epss":0.00323,"epssPercentile":0.25164,"ingestedAt":"2026-10-27T16:11:59.222Z","slug":"CVE-2026-117472","body":"## Overview\n\nPsono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.\n\n## Affected\n\n- `Psono >= 4.0.33 < 7.2.4`\n\n## Remediation\n\nUpgrade to Psono Server 7.2.4 or later.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}