Description
sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite config.xml, point the application at an attacker-controlled database, create an administrator account, and plant serialized PublicLink gadget chains triggered via account/viewLink to execute commands.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nuxsmin | sysPass | 3.0.1 – ≤ 3.2.11 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
psylinux/CVE-2026-129110-sysPass ★ 0 · Nov 13, 2026
CVE-2026-129110: unauthenticated reinstallation RCE in sysPass 3.0.1 through 3.2.11
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://github.com/nuxsmin/sysPass/blob/3.2.11/app/modules/web/Controllers/InstallController.php#L80-L110 technical-description
- https://github.com/OpusProjects/sysPass/pull/360 patch issue-tracking
- https://github.com/nuxsmin/sysPass/issues/1954 issue-tracking
- https://github.com/nuxsmin/sysPass product
- VulnCheck Advisory: sysPass 3.0.1 through 3.2.11 Unauthenticated Reinstallation RCE via install/install third-party-advisory