CVE-2026-5779 - Multiple vulnerabilities in MphRx's Minerva

Back Back to CVE browser

CRITICAL

Multiple vulnerabilities in MphRx's Minerva

Published Apr 28, 2026

9.4

CRITICAL

CVSS 4.0

EPSS 0.46%

Description

An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/user/updateUserProfile' endpoint. This allows an authenticated user to modify the information of other registered users. Successful exploitation of this vulnerability allows an authenticated user to modify other users' information, such as their email address, and request a new password via the '/webconnect/#/forgotPassword' endpoint. This could lead to complete account takeover.

Affected products

Vendor MphRx Product Minerva Default
unaffected
- Version
  3.6.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MphRx

Minerva

unaffected

Version	Status	Constraints
3.6.0	affected	-

Remediation

Vendor solution

No solution has been reported yet.

Weaknesses (1)

CWE-284

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26037
Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-mphrxs-minerva
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26037		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-mphrxs-minerva		Third Party Advisory