Description
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
Published: 2026-10-13
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an incorrect access control issue in the ProPhoenix Law RMS v2022.2403.3.101 sensitive API endpoints. An attacker who can reach these endpoints may bypass authentication or authorization checks, potentially accessing or manipulating confidential data and administrative functions. The weakness could lead to data exposure or unauthorized actions within the application.

Affected Systems

ProPhoenix Law RMS version 2022.2403.3.101, a document management system used by legal departments.

Risk and Exploitability

The CVSS score is 9.8, indicating critical severity. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through web-based API calls to the exposed endpoints. The high CVSS score combined with the low EPSS score suggests that, while exploitation is considered unlikely at present, the criticality of the flaw necessitates immediate mitigation.

Generated by OpenCVE AI on October 17, 2026 at 07:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest official patch or upgrade to a version of ProPhoenix Law RMS that has corrected the access control bug.
  • If no patch is available, restrict access to the identified API endpoints by placing them behind authenticated gateways or using firewall rules to limit traffic to authorized IP ranges.
  • Conduct a thorough review of all API endpoints to ensure that proper authentication and authorization checks are implemented, and remediate any other potential access control weaknesses.

Generated by OpenCVE AI on October 17, 2026 at 07:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Title Incorrect Access Control in ProPhoenix Law RMS API Endpoints

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-14T19:23:07.413Z

Reserved: 2024-05-02T00:00:00.000Z

Link: CVE-2024-34320

cve-icon Vulnrichment

Updated: 2026-10-14T19:22:13.027Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T16:17:07.990

Modified: 2026-10-27T19:10:00.123

Link: CVE-2024-34320

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T07:30:04Z

Weaknesses