CVE-2026-5652 - Authorization Bypass Through User-Controlled Key in Crafty Controller

Back Back to CVE browser

CRITICAL

Authorization Bypass Through User-Controlled Key in Crafty Controller

Published Apr 21, 2026

9.0

CRITICAL

CVSS 3.1

EPSS 0.51%

Description

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.

Affected products

Vendor Arcadia Technology, LLC Product Crafty Controller Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=4.10.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Arcadia Technology, LLC

Crafty Controller

unaffected

Version	Status	Constraints
0	affected	<=4.10.2

Remediation

Vendor solution

Upgrade to version 4.10.3

Weaknesses (1)

CWE-639

Authorization Bypass

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24199
Advisory
https://gitlab.com/crafty-controller/crafty-4/-/work_items/705
exploitVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24199		Advisory
https://gitlab.com/crafty-controller/crafty-4/-/work_items/705		exploitVendor Advisory