CVE-2026-12593
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so. Precondition for successful exploitation was a preexisting internal user (with more privileges than the attacker), the attacker knowing its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker would then have had to forge a token creation API request on behalf of the other user and could have authenticated and finalized the token creation with their own OAuth/OIDC credentials. In the worst case, this would mean an attacker could have become Dashboard Administrator and been able to perform all administrative actions if the preexisting internal user had administrative privileges. In combination with a separate weakness, this could have further led to code execution on the host system running the Dashboard with the privileges of the OS-User running the Dashboard server.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceAn undocumented internal Dashboard API endpoint (POST /api/users/~/{user}/tokens) lacks proper authorization validation, allowing an authenticated attacker who knows a privileged internal user's login name to forge token creation requests for that user and finalize the token with their own OAuth/OIDC credentials, potentially achieving Dashboard Administrator privileges and, when combined with a separate vulnerability, code execution.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- Authentication
- X
- User interaction
- None
- Scope
- X
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify if the undocumented API endpoint existsReview API routing configurations, route definitions, or server logs for the presence of the path /api/users/~/{user}/tokens. Search codebase or API documentation for any reference to this endpoint.Affected if The endpoint /api/users/~/{user}/tokens is present in the codebase or responds to requests without documented existence in public API docs.
-
Verify authorization enforcement on the token creation endpointAttempt an authenticated request to POST /api/users/~/{user}/tokens where the authenticated user differs from the target {user} parameter. Check if the request is rejected or allowed without proper permission checks.Affected if Requests to create tokens for a different user succeed without the requester having administrative privileges over that user account.
-
Inspect OAuth/OIDC token finalization flowReview the OAuth/OIDC token handling logic for the endpoint. Check if token creation can be finalized using attacker-controlled OAuth/OIDC credentials by inspecting the token exchange or finalization code.Affected if The token creation process allows an attacker to provide their own OAuth/OIDC credentials to finalize a token intended for a privileged user.
-
Review API access logs for token creation activitySearch API server logs or audit trails for POST requests to /api/users/~/*/tokens. Identify any token creation attempts targeting administrative or privileged user accounts.Affected if Token creation requests targeting privileged users are logged without corresponding legitimate administrative actions.
A user is affected if the undocumented endpoint /api/users/~/{user}/tokens exists in their Dashboard and lacks proper authorization checks, allowing token creation for privileged users via the OAuth/OIDC token finalization flow.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataImplement authorization checks on the undocumented token creation endpoint to verify the requester has permission to create tokens for the target user; disable or properly secure undocumented internal API endpoints and review OAuth/OIDC token handling to prevent token hijacking.
- Consultation8.0 h
- Implementation16.0 h
- Testing20.0 h
- Review / QA12.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $15,424.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-12593 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-12593 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data