CVE-2026-79989

CVE-2026-79989 is an improper authorization flaw (CWE-285) in the password-change function of a product that is not named in the available data: the function accepts a password change without requiring the user's current password or an active elevated (re-authenticated) session. It also lets an account holding only the 'Edit users' permission, which should not permit password changes, change other users' passwords even though the 'Administrate users' permission is required for that action. An attacker with any low-privileged account can therefore change their own password without proving knowledge of the old one, and an attacker with an 'Edit users' account can reset other users' passwords, enabling account takeover of higher-value accounts, which is reflected in the CVSS 4.0 impact ratings (VC:H/VI:H/VA:H, score 8.7 high). Because the vendor, product, and affected versions are not disclosed in the source record, all deployments of the affected software must be presumed exposed until vendor guidance is available. No public proof of concept, in-the-wild exploitation, or CISA KEV listing is known; EPSS estimates a 0.3% (24th percentile) probability of exploitation within 30 days.

What to do: Contact the vendor for a patched release, since no fixed version is given in the available data, and apply it as soon as it is available. Until then, audit which accounts hold the 'Edit users' permission, restrict that grant to the minimum needed, and review authentication and audit logs for unexpected password changes, especially on privileged accounts. Consider enforcing a current-password check or re-authentication for password changes at the application or proxy layer if a configuration option exists.