CVE-2026-86808: Missing Authentication in moltis-org moltis
Description
A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_handler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 20260819.01 is sufficient to fix this issue. The name of the patch is 3b92dd64d5648f829968cf48bf67dc3113852fef. Upgrading the affected component is advised.
CVSS v4.0
Score 6.9medium
Affected software
moltis-org
moltis
pkg:github/moltis-org/moltiscpe:2.3:a:moltis-org:moltis:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-86808 affects moltis-org moltis versions up to 20260818.10. It is caused by missing authentication checks in the vault_unlock_handler and vault_recovery_handler functions in the vault.rs file. This allows remote attackers to manipulate these functions without authentication. The vulnerability has been publicly disclosed, but no known exploits are reported in the wild. The issue is fixed by upgrading to version 20260819.01, which includes the patch identified by commit 3b92dd64d5648f829968cf48bf67dc3113852fef.
Potential Impact
The vulnerability allows remote attackers to bypass authentication mechanisms in the vault_unlock_handler and vault_recovery_handler functions, potentially leading to unauthorized access or manipulation of sensitive vault operations. The CVSS 4.0 score of 6.9 indicates a medium severity impact with network attack vector and no privileges or user interaction required.
Mitigation Recommendations
Upgrade moltis-org moltis to version 20260819.01 or later, which contains the official fix for this vulnerability. No other mitigation is required as the patch fully addresses the missing authentication issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-08T13:10:12.053Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa0640aacd9273b4920a481
Added to database: 09/08/2026, 19:37:46 UTC
Last enriched: 09/16/2026, 01:22:33 UTC
Last updated: 10/23/2026, 15:10:15 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.