Prototype Pollution Vulnerability in Kofrasa Mingo by Kofrasa
CVE-2026-15698

5.3MEDIUM

Key Information:

Vendor

Kofrasa

Status
Mingo
Vendor
CVE Published:
14 July 2026

What is CVE-2026-15698?

A vulnerability exists in Kofrasa Mingo that affects versions up to 7.2.1, allowing an attacker to manipulate the argument Set in the Update API functions (update, updateOne, updateMany). This manipulation can lead to unauthorized modifications of the object prototype attributes, potentially compromising the application. The vulnerability can be exploited remotely, posing significant risks to system integrity. Users are strongly advised to upgrade to version 7.2.2, which addresses this issue with a dedicated patch.

Affected Version(s)

mingo 7.2.0

mingo 7.2.1

mingo 7.2.2

References

https://vuldb.com/vuln/378245
vdb-entrytechnical-description
https://vuldb.com/vuln/378245/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-15698
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wjm1 (VulDB User)
.