CVE-2026-65710 describes a missing authorization vulnerability in sysPass up to version 3.2.11. Authenticated users possessing the PUBLICLINK_CREATE profile flag can exploit the absence of AccountAcl checks during public link creation. By invoking the saveCreateFromAccountAction endpoint, attackers can bypass AccountFilterUser restrictions, causing AccountService::getDataForLink to load arbitrary vault accounts. This leads to decryption of credentials with the session master key and serialization of cleartext passwords into the Vault storage on the PublicLink database row. If the generated link hash is later recovered, it enables unauthenticated retrieval of these passwords.

The vulnerability allows unauthorized decryption and persistent storage of any vault account's password by users with limited privileges, effectively bypassing intended access controls. This can lead to exposure of sensitive credentials stored in sysPass, potentially compromising the confidentiality of vault accounts. The CVSS 4.0 score of 7.1 (high severity) reflects the network attack vector, low attack complexity, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the PUBLICLINK_CREATE profile flag to trusted users only and monitor usage of the saveCreateFromAccountAction endpoint. Avoid sharing or exposing public link hashes to prevent unauthorized retrieval of stored passwords.