TI-2026-49922 Aliases CVE-2026-71252 GHSA-c6wq-2527-5fpx

toner-management - Unauthenticated State-Changing Admin Actions

MEDIUM 42CWE-862Published 2026-08-05 · Updated 2026-08-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00511 43rd percentileScored 2026-11-07

Fix Fixed toner-management (raghav993): fixed

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
raghav993	toner-management	all versions	fixed	Patch available	CNA

toner-management Vendorraghav993 Affected all versions Fixed in fixed Patch available CNA

Remediation

Fix · CNA toner-management (raghav993) Fixed in fixed

Timeline

2026-10-02 Threatist record created from CVE-2026-71252
2026-10-03 Alias added: GHSA-c6wq-2527-5fpx

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences