CVE-2026-110972

HighCVSS 8.6/10Last modified Nov 3, 2026

Description

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.

This issue was fixed in metric 334 in version 10.02.002.

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-603

Affected software

Vendor	Product	Versions
Zakład Ubezpieczeń Społecznych	Płatnik	<= 10.02.002

References

Timeline

Published: Oct 30, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1109746.3The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() CVE-2026-1109757.4A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configurat CVE-2026-1109764.9The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user CVE-2026-110985.3Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the CVE-2026-1109817.1The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a CVE-2026-1109824.9The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title CVE-2026-1109834.3The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management CVE-2026-1109859.1A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its impl CVE-2026-1109926.5A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository p CVE-2026-11107.8A flaw has been found in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. This affects the function rtsp_parse_method. This ma CVE-2026-111009.6Use after free in File Input in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spec CVE-2026-1110007.1A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain