CVE-2026-114698: mycred

CVSS: 5.4v3.1MediumReceived

Published 22-10-2026Last modified 22-10-2026

Open JSON

Vulnerability summary

CVE-2026-114698 is a medium (CVSS 5.4) vulnerability in mycred.

Overall risk

22/100

0100

Low · default modelHow is this calculated?

CVSS score

5.4/10

010

Medium · v3.1 (CVE.org)

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

22-10-2026
PublishedVulnerability first disclosed.
22-10-2026
Last modifiedVulnerability information updated.

Description

Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1.

CVSS metrics

2 scores · 2 sources · 1 version

v3.15.4

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Affected systems

Mycred1 product

mycred≤ 4.0.0-beta.1

1 vendor · 1 product

References

1 links

patchstack.com/database/…VDB Entry