Description

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.1 can resolve this issue. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T19:18:09.210Z",
  "pubdate": "2026-09-02T19:18:09.210Z",
  "executiveSummary": "A critical security vulnerability identified in tsi-coop tsi-dpdp-cms versions up to 0.5.0 involves a missing authentication flaw within the Admin Console/DPO Compliance Console.\nThis vulnerability allows unauthenticated remote attackers to bypass security controls and access protected functionality within the web.xml configuration context.\nThe flaw poses a significant risk as it permits unauthorized access to sensitive administrative or compliance interfaces without requiring valid credentials.\nGiven that exploit code has been publicly disclosed, the attack surface is active and requires immediate remediation.\nThe primary impact involves complete circumvention of authentication mechanisms, potentially granting unauthorized actors administrative control over the DPO Compliance Console.\nThe vulnerability is remotely exploitable, necessitating proactive patch management and network-level security controls to mitigate the risk of exploitation.",
  "technicalDetails": "The vulnerability originates from a configuration error within the web.xml deployment descriptor of the Admin Console/DPO Compliance Console component in tsi-coop tsi-dpdp-cms versions 0.5.0 and earlier.\nThe core issue pertains to improper access control enforcement, where security constraints defined in web.xml fail to restrict access to sensitive resources or servlets. This results in a 'Missing Authentication' state, categorized as a failure to enforce authorization checks before processing requests.\nIn a typical Java EE/Jakarta EE web application architecture, the web.xml file serves as the primary configuration mechanism for security constraints, role mappings, and URL pattern protection. If security constraints are improperly defined, omitted, or overwritten, the web container fails to intercept and validate user authentication tokens or sessions before granting access to the underlying business logic or administrative functions.\nThe attack flow involves an unauthenticated remote actor sending specifically crafted HTTP requests directly to the affected endpoints or servlets defined within the Admin Console/DPO Compliance Console. Because the application logic fails to perform an authorization verification step prior to request execution, the attacker can interact with restricted functionalities intended only for authenticated administrative users.\nThis is classified as a remote attack vector because the service port is reachable over the network. Exploitation does not require prior knowledge of legitimate user credentials or established sessions, as the misconfiguration effectively disables the authentication handshake for the affected component.\nPost-exploitation impact includes the potential for unauthorized data access, unauthorized administrative configuration changes, and the exposure of sensitive compliance information managed by the DPO Compliance Console. As exploit vectors have been disclosed, the barrier to entry for adversaries is extremely low, allowing for automated scanning and exploitation of vulnerable deployments.\nThe failure mechanism is systemic to the web deployment configuration and represents a lack of 'secure by default' posture in the component's web application security architecture."
}