CVE-2026-84430: Dynamically-Determined Object Attributes in gouguoa
Description
A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised.
CVSS v4.0
Score 5.3medium
Affected software
gouguoa
cpe:2.3:a:gouguoa:gouguoa:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in gouguoa affects the update function of the edit_personal endpoint, specifically in the file app/home/controller/Index.php. By manipulating the position_id argument, an attacker can cause dynamically-determined object attributes, which may lead to unintended behavior or security issues. The vulnerability is remotely exploitable and has a CVSS 4.0 base score of 5.3 (medium severity). The issue is fixed in gouguoa version 6.0.3.
Potential Impact
The vulnerability allows remote attackers to manipulate object attributes dynamically via the position_id parameter, potentially leading to unauthorized actions or data manipulation. The CVSS score of 5.3 indicates a medium impact with low attack complexity and no user interaction required. There is a public exploit disclosed, increasing the risk of exploitation.
Mitigation Recommendations
Upgrade gouguoa to version 6.0.3 or later to remediate this vulnerability. No official patch or temporary fix details are provided beyond this upgrade recommendation. Since the vulnerability is not in a cloud service, remediation depends on applying the vendor's fixed version.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-01T18:41:46.981Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a977a61acd9273b49923c28
Added to database: 09/02/2026, 01:22:41 UTC
Last enriched: 09/07/2026, 13:59:34 UTC
Last updated: 10/17/2026, 06:48:21 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.