---
id: CVE-2026-117472
title: URL prefix handling permits API key read-scope bypass in Psono Server
summary: >-
  Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path
  for the bulk-secret-read endpoint with a hard-coded unprefixed path. In
  deployments configured with URL_PREFIX, the comparison failed and the POST
  request was …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: esaqa GmbH
product: Psono
affected:
  - Psono >= 4.0.33 < 7.2.4
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T05:56:16.775Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117472'
references:
  - url: >-
      https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117472.md
    label: Vendor security advisory for CVE-2026-117472
  - url: >-
      https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/permissions.py
  - url: >-
      https://gitlab.com/esaqa/psono/psono-server/-/commit/5638d4be806af7d1dea03f7cad3927aa2bd19cf4
  - url: 'https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4'
  - url: 'https://gitlab.com/esaqa/psono/psono-server'
tags:
  - cve.org
epss: 0.00323
epssPercentile: 0.25164
ingestedAt: '2026-10-27T16:11:59.222Z'
---

## Overview

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.

## Affected

- `Psono >= 4.0.33 < 7.2.4`

## Remediation

Upgrade to Psono Server 7.2.4 or later.