CVE-2026-5652

The vulnerability stems from improper permission validation in the user management API. An attacker with an account in the system can send API requests directly referencing objects (user accounts) other than those they should have access to. The lack of proper server-side authorization control allows circumventing restrictions resulting from the assigned role and performing modification operations on any user account.

An attacker can modify data of other system users, including potentially administrator accounts, which may lead to system takeover, privilege escalation, or violation of integrity and confidentiality of managed resources.

Apply patches available from the vendor according to the references (https://gitlab.com/crafty-controller/crafty-4/-/work_items/705). It is recommended to restrict access to the administrative panel exclusively to trusted networks and to regularly review user account permissions until the patch is implemented.

Craftycontrol Crafty Controller — versions specified in the vendor references