Jeebase updateUser dynamically-determined object attribute modification
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-915.
Summary
Jeebase 0.0.1 contains an improper control of dynamically-determined object attributes (CWE-915, with CWE-913 also listed) in the updateUser function of the file /user/update/info, part of the UserService component. Remote manipulation of the user/tempUser argument can modify dynamically-determined object attributes. A public exploit has been disclosed and may be used. The project received an early issue report but has not responded.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
A vulnerability was determined in Jeebase 0.0.1. This vulnerability affects the function updateUser of the file /user/update/info of the component UserService. Executing a manipulation of the argument user/tempUser can lead to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Jeebase | 0.0.1 | — | No fix listed | CNA |
- Jeebase Vendor— Affected 0.0.1 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jeebase:jeebase:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:jeebase:jeebase:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
No fix is listed for Jeebase. The project has not responded to the early issue report, so no patched version is available at this time.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-05 Threatist record created from CVE-2026-105180
- 2026-10-05 Alias added: GHSA-vfjh-qwj2-3cv9
- 2026-10-05 CISA SSVC decision points changed
- 2026-10-05 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-105180 · CVE Program
- CVE-2026-105180 · NVD
- FIRST EPSS
- GHSA-vfjh-qwj2-3cv9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences