Loading story…
MphRx's Minerva 3.6.0 was found to contain two high-severity insecure direct object reference vulnerabilities, tracked as CVE-2026-5779 and CVE-2026-5780, that let authenticated users bypass authorization controls. The first issue affects the /minerva/user/updateUserProfile endpoint and allows a logged-in user to modify another registered user's profile information. The second affects /minerva/moUser/show/, where changing an ID parameter can expose other users' data, including user listings, without proper access checks.
The profile-modification flaw can be chained with the /webconnect/#/forgotPassword function to trigger password resets for other users, creating a path to full account takeover. Both CVEs were classified under CWE-284 and published through CVE records referencing an INCIBE-CERT advisory on multiple vulnerabilities in Minerva, with scoring that indicates low attack complexity, low privileges required, and significant confidentiality and integrity impact.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
New CVE entries were published for two high-severity vulnerabilities in MphRx Minerva 3.6.0. CVE-2026-5779 described unauthorized modification of other users' profiles with possible account takeover chaining, while CVE-2026-5780 described unauthorized access to other users' data through ID parameter manipulation.
INCIBE published a notice covering multiple vulnerabilities in MphRx's Minerva product, including the two IDOR flaws later tracked as CVE-2026-5779 and CVE-2026-5780. The advisory documented risks including unauthorized access to user data and potential account takeover through password-reset abuse.
On 2026-04-28, CVE coordination at INCIBE received reports for two insecure direct object reference vulnerabilities affecting MphRx Minerva 3.6.0. The issues involved unauthorized profile modification via '/minerva/user/updateUserProfile' and unauthorized data access via '/minerva/moUser/show/'.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several newly disclosed **Admidio** vulnerabilities allow unauthorized or improperly authorized state-changing actions in core modules handling roles, documents, and forums. One flaw in `modules/groups-roles/groups_roles.php` is a **CSRF** issue that can let an attacker trick an authenticated user with `rol_assign_roles` privileges into activating, deactivating, or deleting organizational roles because the server does not properly enforce anti-CSRF validation for some sensitive requests. Additional Admidio issues stem from **missing authorization checks** on destructive actions, allowing operations to proceed after insufficient validation. In the documents module, `modules/documents-files.php` uses read-access checks such as `getFolderForDownload()` and `getFileForDownload()` before executing `folder_delete` and `file_delete`, which can let any user who can view a file or folder delete it; in public-mode configurations, that can extend to **unauthenticated deletion** of public content. In the forum module, `modules/forum.php` validates a CSRF token for `topic_delete` and `post_delete` actions but fails to verify whether the requester is actually authorized to delete the targeted content, enabling arbitrary forum post or topic deletion. A separate disclosure affecting **Campus Educativa** describes an **IDOR** at `/administracion/admin_usuarios.cgi` that exposes enrolled-user data through brute-forced course IDs, but that is a different product and incident and should be treated separately.
Jun 29, 2026
The Canadian Centre for Cyber Security warned that **MISP CTI-Transmute** versions `<= 1.4.0` are affected by multiple vulnerabilities, including **CVE-2026-69082** and **CVE-2026-69079`. One flaw allows **cross-site request forgery (CSRF)** against the administrative user-deletion endpoint because `/account/delete/<id>` accepted HTTP `GET` requests for a state-changing action, letting an attacker trick a logged-in administrator into deleting a chosen user account. The issue could cause unauthorized state changes, denial of access for affected users, and potential disruption if administrator accounts are targeted. A second high-severity flaw allows **unauthenticated denial of service** through the `/activity_timeline` endpoint, where an unbounded `days` parameter could be abused to force excessive database, CPU, and memory consumption and degrade site availability. The advisory also referenced remediation for blocking file and network fetches during evaluation PDF rendering, alongside fixes that cap the timeline range and require `POST` plus CSRF protection for user deletion. Administrators were urged to review the linked fixes and apply updates as they become available.
Aug 4, 2026
Several critical and high-severity vulnerabilities have been identified in Imaster's MEMS Events CRM and Patient Records Management System, including SQL injection and stored Cross-Site Scripting (XSS) flaws. The vulnerabilities, tracked as CVE-2025-41003, CVE-2025-41004, CVE-2025-41005, and CVE-2025-41006, were discovered by Gonzalo Aguilar García (6h4ack) and coordinated by INCIBE. Specifically, SQL injection vulnerabilities exist in the 'id' parameter of `/projects/hospital/admin/complaints.php` (CVE-2025-41004), the 'keyword' parameter of `/memsdemo/exchange_offers.php` (CVE-2025-41005), and the 'phone' parameter of `/memsdemo/login.php` (CVE-2025-41006`). Additionally, a stored XSS vulnerability (CVE-2025-41003) affects the 'firstname' parameter in `/projects/hospital/admin/edit_patient.php`. All vulnerabilities are remotely exploitable, with CVSS v4.0 base scores ranging from 5.1 (medium) to 9.3 (critical), and no patches have been reported as available. The vulnerabilities impact enterprise management software used for event and patient record management, posing significant risks of unauthorized access, data exfiltration, and potential compromise of sensitive information. The SQL injection flaws, in particular, allow attackers to execute arbitrary SQL commands, potentially leading to full database compromise. The stored XSS vulnerability enables the execution of arbitrary JavaScript in the context of affected users, increasing the risk of session hijacking and further exploitation. Organizations using Imaster's MEMS Events CRM or Patient Records Management System should urgently assess their exposure and implement compensating controls until official fixes are released.
Jun 29, 2026