CVE-2026-6571

CVE-2026-6571 is an authorization bypass vulnerability affecting KodCloud KodExplorer versions up to 4.52, where an attacker can manipulate the group_role argument in the roleGroupAction function of /app/controller/systemRole.class.php to circumvent access controls. This weakness allows authenticated users to perform unauthorized actions within the application, potentially escalating privileges or accessing restricted functionality. The vulnerability carries a CVSS score of 6.3 (Medium severity) with a network-based attack vector, low complexity, and low privilege requirements. Exploitation requires valid user credentials but no user interaction, and the impact includes confidentiality, integrity, and availability compromise at the application level. The relatively modest CVSS score reflects the authentication requirement, though the authorization bypass nature of the flaw represents a meaningful control weakness. Public exploit code is available for this vulnerability, and it is currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as actively exploited. The FAUCET risk score of 44/100 and inclusion on the Hot List indicate elevated real-world concern. The vendor was notified early but did not respond or provide patches, leaving all affected users without official remediation options.