CVE-2026-64852

The CVSS score for this IDOR understates the real risk because it measures vulnerability severity in isolation from its operational impact. What makes this critical is not the authorization gap itself — it's that exploiting it produces a persistent, exfiltratable credential rather than a time-limited session. In practice, a basic panel user can call the apiKeyGenerate endpoint with a route parameter specifying an admin or api.super account, and the plugin will create a long-lived API key bound to that target's full permission set. The attacker walks away with credentials that survive password changes, session expiration, and account deactivation — until the underlying account is deleted. This transforms a privilege escalation into a durable backdoor. The root cause is a conflation of authentication with authorization. The plugin validates that the caller is an authenticated admin but never checks whether that caller has the right to manipulate credentials for the specified target account. The route parameter — essentially an object reference — is trusted implicitly once identity is confirmed. This is an insecure direct object reference where the object is the relationship between an account and its API permissions. Your priority actions: First, verify whether your deployment runs any version before 1.0.8 and upgrade immediately. Second, audit ApiKeyManager for any unexpected keys, particularly those created around the time of the vulnerable version's deployment — look for keys bound to accounts that did not create them. Third, if you cannot upgrade immediately, restrict access to the apiKeyGenerate and apiKeyRevoke endpoints at the web server level to trusted IP sources. The uncomfortable reality is that any keys generated under the vulnerable version remain valid unless manually revoked, since the fix does not automatically invalidate historical credentials.

Reviewed through automated stages and approved by a human before publication.