What’s Vulnerable › Vulnerabilities
CVE-2026-93556: Direct references to unsafe objects (IDOR) in Tankuam Places by Kompini
- Severity: critical (CVSS 9.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-22 · updated 2026-09-22
- Weakness: CWE-639
Description
The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts, which could allow them to take control of the account.
Affected products
- Kompini Tankuam Places: before 25 November 2025 — fixed in 25 November 2025
How to fix
Upgrade to a fixed version: Kompini Tankuam Places 25 November 2025. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-93556 or the next vulnerability affects your stack