CVE-2026-17038

6.9 mediumEPSS 0.4%

Medium (6.9). EPSS 0.4% chance of exploitation in the next 30 days.

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2026-09-10
Modified: 2026-09-10
Record from: the NVD, synced 2026-10-19

References

https://cert.pl/posts/2026/09/CVE-2026-17038
https://dreryk.pl/produkty/gabinet/

Check your stack JSON