CVE-2026-57867

HighCVSS 8.8/10Last modified Jul 7, 2026

Description

MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate deployments to brute-force One-Time Passwords (OTP) to log in as any user. This issue affects MicroRealEstate: through 1.0.0-alpha3.

Metrics

CVSS 4.0 8.8/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published
Jul 7, 2026
Last modified
Jul 7, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-578687.1MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: throCVE-2026-578697.1Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers tCVE-2026-57879.1An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker CVE-2026-578705.3Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other orgaCVE-2026-578717.1Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. CVE-2026-578727.5An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vCVE-2026-578737.5An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and eaCVE-2026-578747.5An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. ThCVE-2026-578757.5An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsing logic of multiple CGI components in GeoVision GCVE-2026-578767.5An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulneCVE-2026-578778.6An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability iCVE-2026-578789.8An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The