CVE-2026-4588
LOWkalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key
Title source: cnaDescription
A vulnerability was determined in kalcaddle kodbox 1.64. Impacted is the function shareSafeGroup of the file /workspace/source-code/app/controller/explorer/shareOut.class.php of the component Site-level API key Handler. This manipulation of the argument sk causes use of hard-coded cryptographic key . The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
CVSS v3
3.7
EPSS
0.0004
EPSS Percentile
11.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-320
CWE-321
Status
published
Products (1)
kalcaddle/kodbox
1.64
Published
Mar 23, 2026
Tracked Since
Mar 23, 2026