← CVE Intelligence

CVE-2026-5652

Authorization Bypass Through User-Controlled Key in Crafty Controller PUBLISHED

Description (CNA)

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.

Affected (CNA)

Vendor / productVersions
Arcadia Technology, LLC / Crafty Controlleraffected 0 through 4.10.2

CWE

CWE-639

References

ADP enrichment

CISA-ADP

No English description supplied.