{"id":"CVE-2026-116471","aliases":[],"cve":{"records":[{"id":"CVE-2026-116471","source":"VulDB","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-26T10:40:46.395Z","published":"2026-10-26T18:30:15.152Z","modified":"2026-10-31T01:42:29.614Z"}],"publishers":[{"name":"VulDB","role":"CNA","organizationId":"1af790b2-7ee1-4545-860a-a788eba489b5","modified":"2026-10-26T18:30:15.152Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-31T01:42:29.614Z"}],"references":[{"url":"https://vuldb.com/vuln/426379","tags":["vdb-entry","technical-description"],"source":"VulDB"},{"url":"https://vuldb.com/vuln/426379/cti","tags":["signature","permissions-required"],"source":"VulDB"},{"url":"https://vuldb.com/cve/CVE-2026-116471","tags":["third-party-advisory"],"source":"VulDB"},{"url":"https://vuldb.com/submit/1014294","tags":["third-party-advisory"],"source":"VulDB"},{"url":"https://docs.google.com/document/d/1aMqfRWKalkL5v9tM5nIxrOWKLbN23KLyr0jSZtan4U4/edit?usp=sharing","tags":["exploit"],"source":"VulDB"}],"weaknesses":[{"id":"CWE-269","description":"Improper Privilege Management","source":"VulDB"},{"id":"CWE-266","description":"Incorrect Privilege Assignment","source":"VulDB"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-31T01:42:20.747022Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"BKWLD Decoy Authorization Policy Policy.php privileges management","titleSource":"VulDB","descriptionSource":"VulDB","description":"A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","score":5.3,"severity":"medium","published":"2026-10-26T18:30:15.152Z","modified":"2026-10-31T01:42:29.614Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"BKWLD","name":"Decoy","platforms":[],"versions":[{"version":"5.11.0","status":"affected"},{"version":"5.11.1","status":"affected"}],"cpes":["cpe:2.3:a:bkwld:decoy:*:*:*:*:*:*:*:*"],"source":"VulDB","url":"https://www.cve.org/CVERecord?id=CVE-2026-116471"}],"remediation":[],"references":["https://vuldb.com/vuln/426379","https://vuldb.com/vuln/426379/cti","https://vuldb.com/cve/CVE-2026-116471","https://vuldb.com/submit/1014294","https://docs.google.com/document/d/1aMqfRWKalkL5v9tM5nIxrOWKLbN23KLyr0jSZtan4U4/edit?usp=sharing"],"sources":[{"name":"CVE","id":"CVE-2026-116471","modified":"2026-10-31T01:42:29.614Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116471"}],"assessments":[{"source":"VulDB","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","score":5.3},{"source":"VulDB","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C","score":4.3},{"source":"VulDB","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C","score":4.3},{"source":"VulDB","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C","score":4}],"sourceAffected":[],"observedAt":"2026-10-31T01:57:46.017Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T06:15:31.892Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-31T02:05:40.288Z","attemptedAt":"2026-10-31T02:05:40.288Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-31T02:05:40.239Z","attemptedAt":"2026-10-31T02:05:40.239Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-31T02:05:40.180Z","attemptedAt":"2026-10-31T02:05:40.180Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-31T02:05:40.748Z","attemptedAt":"2026-10-31T02:05:40.748Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-110066","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-110066","modified":"Oct 26, 2026, 6:30:15 PM","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","checkedAt":"2026-10-31T02:05:40.180Z"},{"source":"GitHub Advisory Database","id":"GHSA-4294-m2vx-p5cx","url":"https://github.com/advisories/GHSA-4294-m2vx-p5cx","modified":"2026-10-26T21:36:14Z","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-10-31T02:05:40.239Z"},{"source":"NVD","id":"CVE-2026-116471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116471","modified":"2026-10-27T14:52:13.410","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-31T02:05:40.288Z"},{"source":"NVD","id":"CVE-2026-116471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116471","modified":"2026-10-27T14:52:13.410","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-10-31T02:05:40.288Z"},{"source":"NVD","id":"CVE-2026-116471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116471","modified":"2026-10-27T14:52:13.410","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","checkedAt":"2026-10-31T02:05:40.288Z"},{"source":"FIRST EPSS","id":"CVE-2026-116471","url":"https://www.first.org/epss/","probability":0.00198,"percentile":0.09634,"date":"2026-10-30","checkedAt":"2026-10-31T02:05:40.748Z"}],"aiSummary":{"text":"BKWLD Decoy up to version 5.11.1 has a security flaw in Policy.php, where manipulating the 'role' argument leads to improper privilege management, potentially exploitable from remote. The impact and required attacker access are unclear. A public exploit is available.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:14:52.975Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-116471"}]}}