CVE-2026-40802

Summary

The flaw allows authenticated users to modify subscriber settings in the Pubjet system without proper authorization checks, potentially enabling privilege escalation or unauthorized data modifications. This affects versions 5.4.8 and earlier.

Exploitability

Exploitation requires an authenticated user account with access to subscriber settings functionality, making it moderately difficult to exploit without prior access.

Blast radius

If exploited, this vulnerability could allow attackers to modify subscriber configurations, potentially leading to unauthorized content delivery or data exposure across multiple user accounts.

Detection

Monitor authentication logs for unusual subscriber setting modification requests from authenticated users, particularly those that bypass normal access controls.

Prioritized remediation

Upgrade to Pubjet version 5.4.9 or later to address the subscriber settings authorization flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.