PT-2026-22213 · Manyfold · Manyfold

Floppy · Publicado 2026-02-26 · Atualizado 2026-02-27 · CVE-2026-28225

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Manyfold versions prior to 0.133.1

Description Manyfold is a self-hosted web application for managing 3d models. A flaw exists in the get model method within the ModelFilesController (lines 158-160) where models are loaded using Model.find param(params[:model id]) without proper authorization checks via policy scope(). This bypasses Pundit authorization, potentially allowing unauthorized access to models. Other controllers correctly implement authorization using policy scope(Model).find param(). The model id parameter is involved in this issue.

Recommendations Update to version 0.133.1 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-28225

GHSA-V8PW-3R2F-3FQM

Produtos afetados

Manyfold

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28225.json · Exploit
• 🔥 https://github.com/manyfold3d/manyfold/security/advisories/GHSA-v8pw-3r2f-3fqm · Exploit
• https://github.com/manyfold3d/manyfold/releases/tag/v0.133.1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-28225 · Nota de Segurança
• https://twitter.com/CVEnew/status/2027466636320772475 · Publicação no Twitter
• https://t.me/cveNotify/153538 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2027190575477252273 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28225 · Aviso do Fabricante