CVE-2026-108810
5.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-200, CWE-284
Impact
Remote, unauthenticated attackers can enumerate API parameter schemas and extract system information. A public exploit is already available.
Root cause
Improper access control in the JSON Schema Validation component allows unauthenticated users to query schema data via the _func parameter.
Affected systems
tsi-coop tsi-dpdp-cms 0.5.0, 0.5.1, and 0.5.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade tsi-dpdp-cms to version 0.5.3 or later. If upgrading immediately is not possible, block unauthenticated requests carrying the _func query argument at your reverse proxy or WAF.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument _func results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.3 is recommended to address this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
References
- https://github.com/kavinkumarst/TSI-DPDP-CMS-API-Parameter-Schema-Enumerable-Without-Authentication/blob/main/README.md
- https://github.com/tsi-coop/tsi-dpdp-cms/
- https://github.com/tsi-coop/tsi-dpdp-cms/blob/v0.5.3/docs/security-fixes/4.md
- https://github.com/tsi-coop/tsi-dpdp-cms/releases/tag/v0.5.3
- https://vuldb.com/cve/CVE-2026-108810
- https://vuldb.com/submit/963801
- https://vuldb.com/vuln/416587
- https://vuldb.com/vuln/416587/cti