Description

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-21T20:16:44.680Z",
  "pubdate": "2026-08-21T20:16:44.680Z",
  "executiveSummary": "Craftplan before version 0.5.1 suffers from a critical broken access control vulnerability residing within the Settings resource handler.\nThe flaw allows unauthenticated remote attackers to bypass all identity verification and access control mechanisms, facilitating the direct retrieval of highly sensitive system credentials including decrypted SMTP passwords, email API keys, and email API secrets.\nThis vulnerability poses a severe risk to confidentiality, potentially exposing critical infrastructure credentials and enabling downstream attacks such as unauthorized email relaying or lateral movement.\nExploitation requires no prior authentication, privileged access, or complex user interaction, relying solely on network connectivity to the application's API endpoints and knowledge of a valid record ID.\nRisk implications include full compromise of integrated mail services and exposure of internal operational secrets stored within the application state.\nRemediation requires upgrading Craftplan to version 0.5.1 or later, where proper authorization policies and authentication checks are enforced on the affected API routes.",
  "technicalDetails": "The vulnerability is rooted in the implementation of the authorization policy governing the Settings resource within Craftplan versions prior to 0.5.1.\nSpecifically, the root cause stems from an unconditional authorization policy configured on the settings API endpoint, functioning as an always-allow access check.\nDue to this misconfiguration, the application fails to validate the identity or session state of incoming clients before processing requests directed at the resource.\nThe vulnerable component is the access control enforcement layer protecting the settings API endpoint.\nAttackers can execute exploitation by transmitting an unauthenticated HTTP GET request directly to the settings API endpoint.\nTo successfully retrieve sensitive records, the request must include a valid record ID corresponding to the target configuration entry.\nUpon receiving the request, the backend processes the retrieval logic without evaluating authentication tokens, session cookies, or access control lists.\nThe application subsequently queries the database, retrieves the requested settings record, and returns the deserialized data containing plaintext or decrypted sensitive values, including SMTP passwords, email API keys, and email API secrets.\nThe attack flow requires network exposure to the web application API, zero authentication credentials, and no specific privilege levels.\nPost-exploitation impact includes the immediate unauthorized disclosure of administrative credentials, enabling attackers to leverage compromised email services for phishing campaigns, internal network reconnaissance, or further unauthorized access."
}