CVE-2026-5652

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.

Score

CVSS 3.1 9.0 Critical

Status

Analyzed - cve@gitlab.com

Published

2026-04-21

Last modified

2026-10-26

Weaknesses

CWE-639

Affected products

• Crafty Controller (Arcadia Technology Llc)
• Crafty Controller (Craftycontrol)

References

• https://gitlab.com/crafty-controller/crafty-4/-/work_items/705