{"id":"CVE-2023-26770","aliases":["EUVD-2023-30563","GHSA-gv59-h7rc-cxvr"],"status":"published","title":"TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a...","description":"TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00724,"percentile":0.54495,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2024-10-04T00:00:00Z","modified":"2026-10-28T02:30:41Z","products":[{"vendor":"taskcafe_project","product":"taskcafe"}],"references":[{"url":"https://github.com/JordanKnott/taskcafe","tags":["Product","package"]},{"url":"https://bishopfox.com/blog/taskcafe-version-0-3-2-advisory","tags":["Exploit","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26770","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gv59-h7rc-cxvr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26770.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-26770","description":"TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.","status":"published","published":"2024-10-04T00:00:00Z","modified":"2024-10-04T22:17:08.227Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:15.779187Z"}],"euvd":[{"id":"EUVD-2023-30563","description":"TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.","status":"published","published":"2024-10-04T00:00:00Z","modified":"2024-10-04T22:17:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:27:49.014643Z"}],"ghsa":[{"id":"GHSA-gv59-h7rc-cxvr","title":"TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a...","description":"TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.","status":"published","published":"2024-10-04T21:31:29Z","modified":"2024-10-07T21:34:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:58:25.780996Z"}],"nvd":[{"id":"CVE-2023-26770","description":"TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.","status":"published","published":"2024-10-04T19:15:15.87Z","modified":"2026-06-17T05:43:46.513Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:09:19.052418Z"}],"osv":[{"id":"CVE-2023-26770","description":"TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.","status":"published","published":"2024-10-04T00:00:00Z","modified":"2026-10-28T02:30:41.929760027Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:31.135751Z"}]}}