by Kastro
Paper/Archive/CVE-2026-5779

CVE-2026-5779

MphRx Minerva — Multiple vulnerabilities in MphRx's Minerva

EPSS 0.3%CVSS 9.4
critical.is priorityof 100
32
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 16.8.168 × 203.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/user/updateUserProfile' endpoint. This allows an authenticated user to modify the information of other registered users. Successful exploitation of this vulnerability allows an authenticated user to modify other users' information, such as their email address, and request a new password via the '/webconnect/#/forgotPassword' endpoint. This could lead to complete account takeover.

Affected

ProductAffectedFixed inSource
Minerva3.6.0–CNA

Scores by source

INCIBE (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refincibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-mphrxs-minerva