A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. (CVE-2026-84430)
Description
A security vulnerability (CVE-2026-84430) exists in gouguoa up to versions 5.10.0 and 6.0.1. It affects the update function in the app/home/controller/Index.php file, specifically the edit_personal endpoint. The vulnerability involves manipulation of the position_id argument, leading to dynamically-determined object attributes. The vulnerability can be exploited remotely. Public exploit code has been disclosed. Upgrading to version 6.0.3 resolves the issue.
CVSS v3.1
Score 6.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-84430 is a vulnerability in gouguoa affecting the update function of the edit_personal endpoint in app/home/controller/Index.php. The flaw arises from manipulation of the position_id argument, which results in dynamically-determined object attributes, potentially allowing unauthorized remote actions. The vulnerability is exploitable remotely and public exploit code is available. The issue is fixed by upgrading to gouguoa version 6.0.3.
Potential Impact
The vulnerability allows remote attackers to manipulate the position_id argument, which leads to dynamically-determined object attributes. This can impact confidentiality, integrity, and availability, as indicated by the CVSS vector (C:L/I:L/A:L). The CVSS score is 6.3 (medium severity). No known exploits in the wild have been reported yet.
Mitigation Recommendations
Upgrade gouguoa to version 6.0.3 to resolve this vulnerability. No other mitigation or temporary fixes are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vxcj-vv77-fr73
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-84430"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a984563acd9273b496ac4fe
Added to database: 09/02/2026, 15:48:51 UTC
Last enriched: 09/07/2026, 22:37:49 UTC
Last updated: 10/18/2026, 18:48:24 UTC
Views: 55
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.