CVE-2010-1326

perms.cpp in March Hare Software CVSNT 2.0.58, 2.5.01, 2.5.02, 2.5.03 before build 3736, 2.5.04...

9.3 HighFix available

perms.cpp in March Hare Software CVSNT 2.0.58, 2.5.01, 2.5.02, 2.5.03 before build 3736, 2.5.04 before build 2862; CVS Suite 2.5.03, 2008 before build 3736, and 2009 before 3729 allows remote attackers to bypass the permissions check, modify arbitrary modules and directories within CVSROOT, and execute arbitrary code via a crafted branch name ACL, possibly related to incorrect inheritance.

Exploit likelihood

5.15%Down 2.6 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2010-1326
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2010-1326
Updated: 2026-11-02

EUVDEUVD-2010-1355 No score

Record: EUVD-2010-1355
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3wr4-x8jr-m3cm No score

perms.cpp in March Hare Software CVSNT 2.0.58, 2.5.01, 2.5.02, 2.5.03 before build 3736, 2.5.04...

Record: GHSA-3wr4-x8jr-m3cm
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`cvsnt` Debian:5.0	before 2.5.03.2382-3.3+lenny1, plus listed versions 2.5.03.2382-3.3	2.5.03.2382-3.3+lenny1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-1326 is a high vulnerability (CVSS 9.3) in March-hare Cvs Suite, published September 14, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.15%, the 92nd percentile. Fixed in cvsnt 2.5.03.2382-3.3+lenny1.