sysPass up to version 3.2.11 contains a missing authorization defect in the PublicLinkController that allows authenticated users with the PUBLICLINK_CREATE profile to trigger an unauthorized decryption of any vault account, persist the cleartext password in the PublicLink database row, and subsequently expose that password to unauthenticated users who obtain the public link hash. The flaw exists because AccountAcl checks are omitted during the public link creation flow, enabling AccountService::getDataForLink to load arbitrary target accounts without respecting AccountFilterUser restrictions. This allows an attacker who can invoke the saveCreateFromAccountAction endpoint to deserialize cleartext credentials and store them permanently, effectively leaking confidential password material.

The affected vendor is nuxsmin and the product is sysPass, with the vulnerability present in all releases up to and including 3.2.11. No other versions or products are listed as affected in the CNA data.

The CVSS score of 7.1 indicates a high severity due to potential data leakage, while the EPSS score of less than 1% suggests a low probability of exploitation in the broader threat landscape. The vulnerability is not listed in the CISA KEV catalog, implying that no publicly documented exploitation has yet been reported. Because the flaw requires authentication with the PUBLICLINK_CREATE profile, the attack surface is limited to insiders or compromised accounts, and the gain from exploitation is limited to obtaining vault passwords rather than full system compromise.