What’s Vulnerable › Vulnerabilities
CVE-2026-17038: Use of Hard-coded Credentials in drEryk Gabinet
- Severity: medium (CVSS 6.9 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-10 · updated 2026-09-10
- Weakness: CWE-798
Description
DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets.
Affected products
- drEryk Gabinet: before 11.5.0 — fixed in 11.5.0
How to fix
Upgrade to a fixed version: drEryk Gabinet 11.5.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-17038 or the next vulnerability affects your stack