Description
A vulnerability was determined in Jeebase 0.0.1. This vulnerability affects the function updateUser of the file /user/update/info of the component UserService. Executing a manipulation of the argument user/tempUser can lead to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure (inferred)
Action: Assess Impact
AI Analysis

Impact

The vulnerability resides in the updateUser function of Jeebase's UserService. An attacker who can provide a crafted user/tempUser argument can influence which object attributes are set dynamically, potentially exposing or modifying sensitive data. This flaw is associated with CWE-913 and CWE-915. Based on the description, it is inferred that the primary impact could be information disclosure or unauthorized data manipulation. This issue allows remote actors to manipulate the service and is publicly disclosed, enabling attackers to exploit the exposed endpoints.

Affected Systems

Jeebase 0.0.1, specifically the UserService component at the /user/update/info endpoint. Any deployment of this version that exposes the UserService to external users is affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, yet it is publicly disclosed and can be executed remotely. The lack of a patch and the remote nature of the attack vector suggest that the risk is real and could be exploited in the wild, especially if proper input validation is missing.

Generated by OpenCVE AI on October 5, 2026 at 04:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the Jeebase project or its maintainers for an updated release that addresses this issue.
  • Add strict validation for the user/tempUser input so only allowed attribute names can be set.
  • Limit access to the UserService endpoints to authenticated users with appropriate permissions.
  • If possible, refactor the updateUser logic to eliminate dynamic attribute assignment or restrict it to a safe subset of attributes.

Generated by OpenCVE AI on October 5, 2026 at 04:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Jeebase 0.0.1. This vulnerability affects the function updateUser of the file /user/update/info of the component UserService. Executing a manipulation of the argument user/tempUser can lead to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Title Jeebase UserService info updateUser dynamically-determined object attributes
First Time appeared Jeebase
Jeebase jeebase
Weaknesses CWE-913
CWE-915
CPEs cpe:2.3:a:jeebase:jeebase:*:*:*:*:*:*:*:*
Vendors & Products Jeebase
Jeebase jeebase
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Jeebase Jeebase
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-05T15:30:35.221Z

Reserved: 2026-10-04T09:22:11.464Z

Link: CVE-2026-105180

cve-icon Vulnrichment

Updated: 2026-10-05T15:26:40.522Z

cve-icon NVD

Status : Deferred

Published: 2026-10-05T02:16:50.217

Modified: 2026-10-06T15:04:52.637

Link: CVE-2026-105180

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T21:09:38Z

Weaknesses
  • CWE-913

    Improper Control of Dynamically-Managed Code Resources

  • CWE-915

    Improperly Controlled Modification of Dynamically-Determined Object Attributes