CVE-2026-86808 PUBLISHED

moltis-org moltis vault.rs vault_recovery_handler missing authentication

Assigner: VulDB
Reserved: 08.09.2026 Published: 08.09.2026 Updated: 08.09.2026

A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_handler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 20260819.01 is sufficient to fix this issue. The name of the patch is 3b92dd64d5648f829968cf48bf67dc3113852fef. Upgrading the affected component is advised.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS Score: 6.9

Product Status

Vendor moltis-org
Product moltis
Versions
  • Version 20260818.0 is affected
  • Version 20260818.1 is affected
  • Version 20260818.2 is affected
  • Version 20260818.3 is affected
  • Version 20260818.4 is affected
  • Version 20260818.5 is affected
  • Version 20260818.6 is affected
  • Version 20260818.7 is affected
  • Version 20260818.8 is affected
  • Version 20260818.9 is affected
  • Version 20260818.10 is affected
  • Version 20260819.01 is unaffected

Credits

  • Customeres (VulDB User) reporter

References

Problem Types

  • Missing Authentication CWE
  • Improper Authentication CWE