CVE-2026-5652

CVE-2026-5652 is an insecure direct object reference vulnerability in the Users API component of Crafty Controller that permits authenticated attackers to modify user accounts through inadequate API permissions validation. The flaw has been assigned a CVSS score of 9.0 (Critical), indicating significant risk potential with high impact across confidentiality, integrity, and availability. The attack requires network access and high-level privileges but demands minimal complexity, enabling remote exploitation by authenticated users with administrative credentials. The vulnerability is not currently listed on the Known Exploited Vulnerabilities catalog and appears inactive on threat intelligence hot lists, suggesting limited active exploitation in the wild. However, the FAUCET Risk Score of 52.0 and relative rarity among disclosed CVEs warrants monitoring and timely remediation to prevent potential unauthorized account manipulation within affected systems.