Description
A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-26
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in an undefined function within the Policy.php file of BKWLD Decoy’s Authorization Policy component. Manipulating the role argument allows an attacker to bypass normal privilege controls, granting unauthorized access to higher level permissions. This flaw enables privilege escalation, potentially compromising confidentiality, integrity, or availability of the application’s data. The weakness is classified under CWE‑266 (Improper Privilege Management) and CWE‑269 (Improper Privilege Escalation).

Affected Systems

The flaw affects BKWLD Decoy versions up to 5.11.1. Unauthorized manipulation of role arguments can occur in any installation running a vulnerable version of this component.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, but the vulnerability is publicly exposed and can be triggered from remote. As the vendor did not issue a proper fix, the risk remains moderate to high until a patch or mitigating action is applied. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 26, 2026 at 19:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update BKWLD Decoy to a version newer than 5.11.1 or apply an official patch if released.
  • Restrict external access to the Authorization Policy interface and enforce strict validation on the role parameter to prevent unauthorized manipulation.
  • Monitor authentication and role change events for suspicious activity, and implement network‑level controls to limit exposure of the vulnerable component.

Generated by OpenCVE AI on October 26, 2026 at 19:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title BKWLD Decoy Authorization Policy Policy.php privileges management
First Time appeared Bkwld
Bkwld decoy
Weaknesses CWE-266
CWE-269
CPEs cpe:2.3:a:bkwld:decoy:*:*:*:*:*:*:*:*
Vendors & Products Bkwld
Bkwld decoy
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Bkwld Decoy
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T18:30:15.152Z

Reserved: 2026-10-26T10:40:46.395Z

Link: CVE-2026-116471

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-26T19:16:30.407

Modified: 2026-10-26T19:16:30.407

Link: CVE-2026-116471

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:30:15Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-269

    Improper Privilege Management