CVE-2026-38470: n/a
Description
CVE-2026-38470 is a broken access control vulnerability in the API user endpoint of GazellePW (GazellePosterWall). It allows unprivileged, authenticated users to enable or disable arbitrary user accounts by using the req=disable or req=enable actions with a normal user-created API token. The vulnerability does not require user interaction and has a medium severity score of 4.3. No specific affected versions or patches are currently documented.
CVSS v3.1
Score 4.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in GazellePW's API user endpoint permits authenticated users with normal API tokens to perform unauthorized actions on other user accounts, specifically enabling or disabling them. This is due to broken access control that fails to properly restrict these actions to privileged users only. The CVSS 3.1 base score is 4.3, reflecting low attack complexity, network attack vector, and limited impact on integrity without confidentiality or availability loss. No official remediation or patch information is currently available.
Potential Impact
An attacker with a valid user API token can enable or disable arbitrary user accounts, potentially disrupting user access or administrative control. There is no confidentiality or availability impact reported. The integrity impact is limited to unauthorized modification of user account status.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict API token permissions where possible and monitor for suspicious account status changes. Avoid using user-created API tokens for sensitive account management actions if feasible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-04-06T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 6a8e0eb7acd9273b49c03ec9
Added to database: 08/25/2026, 21:52:55 UTC
Last enriched: 09/07/2026, 15:51:30 UTC
Last updated: 10/08/2026, 18:48:45 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.