Skip to content
OpenAdvisories

Product · esaqa

Psono

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-128970 Public exploit

    Missing membership acceptance check permits group share-right deletion by invitees in Psono Server

    Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership m…

    esaqa Psono
  • Medium 4.3
    CVE-2026-117472

    URL prefix handling permits API key read-scope bypass in Psono Server

    Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write…

    esaqa Psono
  • Medium 5.4
    CVE-2026-117471

    User-controlled Duo host permits authenticated SSRF in Psono Server

    Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to conn…

    esaqa Psono
  • Medium 6.5
    CVE-2026-117470

    WebAuthn assertion replay permits second-factor bypass in Psono Server

    Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assert…

    esaqa Psono
  • Medium 5.4
    CVE-2026-117469

    File-transfer type confusion permits unauthorized repository writes in Psono Server

    Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endp…

    esaqa Psono
  • Medium 6.5
    CVE-2026-117468

    Device-code claim permits restricted token escalation in Psono Server

    Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code …

    esaqa Psono