Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control… (CVE-2026-114698)

CVE-2026-114698 describes an authorization bypass vulnerability in myCred (up to version 4.0.0-beta.1) caused by incorrectly configured access control security levels. The flaw involves a user-controlled key that can be manipulated to bypass authorization mechanisms, allowing an attacker with low privileges to perform unauthorized actions affecting data integrity and availability. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

Exploitation of this vulnerability can lead to unauthorized actions that compromise the integrity and availability of the affected system. Confidentiality is not impacted according to the CVSS vector. The attacker requires low privileges and no user interaction is needed, making the attack vector network-based.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, review and tighten access control configurations related to user-controlled keys to prevent unauthorized privilege escalation.