Authentication Bypass in OpenPLC V3 Affected by Insufficient Role Verification
CVE-2026-35063
8.7HIGH
What is CVE-2026-35063?
The OpenPLC V3 REST API is vulnerable due to insufficient verification of user roles. Authenticated users with a 'user' role can exploit this flaw to delete other users, including those with administrative privileges, by simply knowing their user IDs. Additionally, these users can create new accounts and assign them administrative roles, granting themselves and others full control over the system. This vulnerability poses a serious risk to system integrity and user data security.
Affected Version(s)
OpenPLC_V3 All versions
References
CVSS V4
Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Arad Inbar, Nir Somech, Ben Grinberg, Daniel Lubel, Erez Cohen, and Adiel Sol from DREAM