CVE-2026-5652
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification…
Published Apr 21, 2026 · updated Jun 17, 2026 · craftycontrol crafty controller
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 21, 2026 · NIST NVD
Detected
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
Jun 17, 2026 · NIST NVD
Updated
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
Affected
- cpe craftycontrol/crafty controllerversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-5652
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-5652
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
nvd.nist.gov