Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: esaqa Psono 7.2.4 Clear all filters
TI-2026-81021 CVE-2026-117472 · GHSA-4hh2-mhpm-69h3

URL prefix handling permits API key read-scope bypass in Psono Server

Priority LOW 20

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00323 Published 2026-10-27 Fixed in 7.2.4 CWE-863
TI-2026-81018 CVE-2026-117471 · GHSA-q3ph-3gv2-g5wq

User-controlled Duo host enables SSRF in Psono Server

Priority LOW 24

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00242 Published 2026-10-27 Fixed in 7.2.4 CWE-918
TI-2026-81016 CVE-2026-117469 · GHSA-jg7j-q6m4-7gq5

Psono file-transfer confusion allows unauthorized repository writes

Priority LOW 24

Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00337 Published 2026-10-27 Fixed in 7.2.4 CWE-862