Access Control Vulnerability in Craftplan by Puemos

CVE-2026-76876

What is CVE-2026-76876?

Craftplan versions prior to 0.5.1 exhibit a broken access control vulnerability, enabling unauthenticated attackers to gain access to sensitive information. This flaw arises from an unconditional authorization policy on the Settings resource, allowing attackers to exploit the settings API endpoint. By initiating a GET request with a valid record ID, attackers can retrieve decrypted SMTP passwords, email API keys, and email API secrets due to a read policy that ignores identity verification. Organizations using this version should update promptly to mitigate risks.

References