CVE-2026-65710 describes a missing authorization vulnerability in sysPass through version 3.2.11. Authenticated users possessing the PUBLICLINK_CREATE profile flag can exploit the lack of AccountAcl checks in the public link creation flow. By invoking the saveCreateFromAccountAction endpoint, attackers cause AccountService::getDataForLink to load arbitrary vault accounts without user-specific filtering. This allows decryption of credentials using the session master key and serialization of cleartext passwords into the Vault storage on the PublicLink database row. If the public link hash is later recovered, it enables unauthenticated retrieval of these passwords, effectively bypassing intended access controls.

An attacker with authenticated access and the PUBLICLINK_CREATE profile flag can access and decrypt any vault account's password, store it persistently in the public link storage, and potentially allow unauthenticated users to retrieve these passwords if the public link hash is exposed. This compromises the confidentiality of stored credentials within sysPass vaults.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the PUBLICLINK_CREATE profile flag to trusted users only and monitor for suspicious use of public link creation features. Avoid sharing or exposing public link hashes to prevent unauthorized password retrieval.