CVE-2026-117472

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URLPREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An...

CVE-2026-117472 URL prefix handling permits API key read-scope bypass in Psono Server

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URLPREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An...

CVE-2026-117472

Psono Server CE && EE versions 4.0.33 through 7.2.3 are vulnerable to an authorization bypass due to incorrect path comparison for the bulk-secret-read endpoint. When configured with URL_PREFIX , the application compares the request path against a hard-coded unprefixed path, causing the compariso...

EUVD-2026-110606

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URLPREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An...