CVE-2026-65710

SysPass 3.2.11 is affected by a missing authorization vulnerability in the PublicLink flow. Authenticated users with the PUBLICLINK_CREATE profile flag can trigger unauthorized decryption and persistence of vault passwords by abusing the absence of AccountAcl checks in the public link creation pa...