CVE-2026-5652 — Authorization Bypass Through User-Controlled Key in Crafty Controller
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions vi…
Published: 2026-04-21 · CVSS: 9.0 · CVSS 3.1
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7