CVE-2026-5251

MEDIUM

z-9527 admin User Update Endpoint user.js dynamically-determined object attributes

Title source: cna

Description

A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-354441 | z-9527 admin User Update Endpoint user.js dynamically-determined object attributes

https://vuldb.com/vuln/354441

Signature, Permissions Required signature permissions-required

VDB-354441 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/354441/cti

Third Party Advisory third-party-advisory

Submit #780607 | z-9527 admin ≤ commit 72aaf2d Dynamically-Determined Object Attributes

https://vuldb.com/submit/780607

Exploit exploit

https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-11

Scores

CVSS v3 6.3

EPSS 0.0006

EPSS Percentile 18.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-913 CWE-915

Status published

Products (2)

z-9527/admin 1.0

z-9527/admin 2.0

Published Apr 01, 2026

Tracked Since Apr 01, 2026