Unzureichende Zugriffskontrolle-Schwachstelle in Fullstep

The primary impact of CVE-2026-5749 lies in the potential for unauthorized access to sensitive data and functionality exposed through Fullstep's API. An attacker who successfully obtains a valid JWT can impersonate an authenticated user and interact with the API as if they were authorized. This could lead to data exfiltration, modification of critical configurations, or even complete compromise of the system, depending on the permissions associated with the obtained token. The scope of the impact is directly tied to the privileges granted by the API resources accessible with the JWT.

Organizations utilizing Fullstep V5 in production environments, particularly those relying on its API for critical business functions, are at risk. Systems with weak API authentication policies or those lacking robust monitoring for suspicious JWT activity are especially vulnerable. Shared hosting environments where multiple users share the same Fullstep instance could also be affected.

1. 2026-04-22Disclosure

   disclosure

1. Reserviert2026-04-07
2. Veröffentlicht2026-04-22
3. EPSS aktualisiert2026-04-30

The most effective mitigation for CVE-2026-5749 is to upgrade to a patched version of Fullstep that addresses the inadequate access control. Until an upgrade is possible, consider implementing temporary workarounds such as stricter API rate limiting to hinder brute-force token acquisition attempts. Implementing robust input validation on registration requests can also help prevent malicious actors from exploiting the vulnerability. Monitor API access logs for suspicious activity, particularly requests originating from unexpected IP addresses or user agents. After upgrade, confirm by reviewing API access logs and verifying that only authorized users can access protected resources.