CVE-2026-117469Medium· 5.4▾ SunlitPsono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download trans…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an attacker-selected object key, and append a chunk to the owner's file. Exploitation could upload or overwrite repository objects and consume storage, subject to transfer size, chunk-count, and lifetime limits.
Psono >= 1.0.0 < 7.2.4Upgrade to Psono Server 7.2.4 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117468Medium· 6.5Device-code claim permits restricted token escalation in Psono Server
CVE-2026-117470Medium· 6.5WebAuthn assertion replay permits second-factor bypass in Psono Server
CVE-2026-117472Medium· 4.3URL prefix handling permits API key read-scope bypass in Psono Server
CVE-2026-117471Medium· 5.4User-controlled Duo host permits authenticated SSRF in Psono Server
CVE-2025-12924Medium· 4.3A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224
CVE-2024-0829Medium· 4.3The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0