CVE-2024-55470

7.5 highEPSS 0.5%

High (7.5). EPSS 0.5% chance of exploitation in the next 30 days.

Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-290
Published: 2024-12-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://gist.github.com/Kaushikjoshi/2d8ad350ba5e72030fcee2536498cfe4
https://github.com/oqtane/oqtane.framework/pull/4878/files

Check your stack JSON