CVE-2026-4171

MEDIUM

CodeGenieApp serverless-express API Endpoint TodoList.ts authorization

Title source: cna
STIX 2.1

Description

A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionality of the file examples/lambda-function-url/packages/api/models/TodoList.ts of the component API Endpoint. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-351078 | CodeGenieApp serverless-express API Endpoint TodoList.ts authorization
https://vuldb.com/?id.351078
Signature, Permissions Required signature permissions-required
VDB-351078 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/?ctiid.351078
Third Party Advisory third-party-advisory
Submit #769769 | CodeGenieApp serverless-express <=4.17.1 Broken Object Level Authorization
https://vuldb.com/?submit.769769
Third Party Advisory third-party-advisory
Submit #769771 | CodeGenieApp @codegenie/serverless-express <=4.17.1 Broken Object Level Authorization (Duplicate)
https://vuldb.com/?submit.769771

Scores

CVSS v3 6.3
EPSS 0.0027
EPSS Percentile 19.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-285 CWE-639
Status published
Products (2)
CodeGenieApp/serverless-express 4.17.0
CodeGenieApp/serverless-express 4.17.1
Published Mar 16, 2026
Tracked Since Mar 16, 2026