Critical IODR Vulnerability in Crafty Controller Puts Servers at Risk

The National Vulnerability Database has disclosed CVE-2026-5652, a critical Insecure Direct Object Reference (IDOR) vulnerability within the Users API component of Crafty Controller. This flaw, rated 9.0 (CRITICAL) on the CVSS scale, allows a remote, authenticated attacker to execute user modification actions without proper authorization. The issue stems from insufficient API permissions validation, enabling an attacker to bypass intended access controls.

This isn’t a theoretical risk; it’s a direct path to privilege escalation or unauthorized user manipulation for anyone with valid credentials, even low-privileged ones. The attacker’s calculus here is simple: gain any level of access, then leverage this IDOR to modify or potentially delete other user accounts, including administrative ones. This effectively gives them control over the entire Crafty Controller instance.

For defenders, this means immediate action. Any organization utilizing Crafty Controller must assume that authenticated attackers can exploit this. The lack of specified affected product versions from the National Vulnerability Database implies a broad impact. This isn’t just about data; it’s about operational integrity and maintaining control over your infrastructure.