The vulnerability CVE-2026-43510 in manage.get.gov allows an organization administrator to incorrectly assign domain manager privileges for domains that are not already part of another organization. This is a privilege assignment flaw categorized under CWE-266. The flaw could lead to unauthorized modification or disruption of domain management. The issue was addressed and fixed in version 1.176.0 released on or around April 30, 2026. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high impact on integrity and availability.

Successful exploitation could allow an organization administrator to assign domain manager privileges improperly, potentially enabling unauthorized changes to domain configurations or disruption of domain services. This impacts the integrity and availability of domain management within the .gov TLD registrar system. There is no confidentiality impact reported. No known exploits in the wild have been identified.

A fix is available in version 1.176.0 of manage.get.gov, released around April 30, 2026. Organizations using affected versions such as 1.92.0 should upgrade to 1.176.0 or later to remediate this vulnerability. No vendor advisory or official remediation level is provided, so patch status beyond this fix is not explicitly confirmed. Patch status is considered fixed in 1.176.0. No additional mitigation guidance is provided.