CVE-2026-23754 is an authorization bypass vulnerability (CWE-639) affecting D-Link D-View 8 versions 2.0.1.107 and earlier. The issue arises from improper access control in backend API endpoints, allowing any authenticated user to specify arbitrary user_id parameters to retrieve sensitive credential data belonging to other users, including those with super administrator privileges. The exposed credentials can be directly reused as valid authentication secrets, enabling full impersonation and account takeover. This vulnerability results in complete administrative control over the affected D-View system.

Successful exploitation allows an authenticated user to bypass authorization controls and retrieve sensitive credential data of other users, including super administrators. This leads to full account takeover and administrative control over the D-View system, potentially compromising all managed network devices and configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the D-View 8 management interface to trusted users only and monitor for suspicious activity. Avoid using affected versions in production environments where possible.