Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.
"}],"value":"Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets."}],"impacts":[{"descriptions":[{"lang":"en","value":"A restricted, short-lived API key session could be escalated to a full read-write session lasting up to 365 days, enabling unauthorized modification of encrypted secrets and shares."}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-27T05:59:08.920Z","orgId":"fdf66990-8419-4c8c-8848-ec15d75773b4","shortName":"esaqa"},"references":[{"tags":["technical-description"],"url":"https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/views/device_code_claim.py"},{"tags":["patch"],"url":"https://gitlab.com/esaqa/psono/psono-server/-/commit/19ed5a192c704fece1645d946b6f4c36045bacbe"},{"tags":["release-notes"],"url":"https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"},{"tags":["product"],"url":"https://gitlab.com/esaqa/psono/psono-server"},{"tags":["vendor-advisory"],"url":"https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117468.md"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to Psono Server 7.2.4 or later.
"}],"value":"Upgrade to Psono Server 7.2.4 or later."}],"source":{"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2026-07-29T16:10:00.000Z","value":"Vulnerability reported to vendor"},{"lang":"en","time":"2026-07-30T07:13:00.000Z","value":"Vendor fix implemented"},{"lang":"en","time":"2026-07-30T13:16:00.000Z","value":"Psono CE & EE Server 7.2.4 released"}],"title":"Device-code claim permits restricted token escalation in Psono Server","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"fdf66990-8419-4c8c-8848-ec15d75773b4","assignerShortName":"esaqa","cveId":"CVE-2026-117468","datePublished":"2026-10-27T05:41:30.742Z","dateReserved":"2026-10-27T05:33:18.001Z","dateUpdated":"2026-10-27T05:59:08.920Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-27 06:17:24","lastModifiedDate":"2026-10-27 06:17:24","problem_types":["CWE-269","CWE-269 CWE-269 Improper Privilege Management"],"metrics":{"cvssMetricV31":[{"source":"fdf66990-8419-4c8c-8848-ec15d75773b4","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"117468","Ordinal":"1","Title":"Device-code claim permits restricted token escalation in Psono S","CVE":"CVE-2026-117468","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"117468","Ordinal":"1","NoteData":"Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.","Type":"Description","Title":"Device-code claim permits restricted token escalation in Psono S"}]}}}