PT-2026-22213 · Manyfold · Manyfold

Floppy · Published 2026-02-26 · Updated 2026-02-27 · CVE-2026-28225

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Manyfold versions prior to 0.133.1

Description Manyfold is a self-hosted web application for managing 3d models. A flaw exists in the get model method within the ModelFilesController (lines 158-160) where models are loaded using Model.find param(params[:model id]) without proper authorization checks via policy scope(). This bypasses Pundit authorization, potentially allowing unauthorized access to models. Other controllers correctly implement authorization using policy scope(Model).find param(). The model id parameter is involved in this issue.

Recommendations Update to version 0.133.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-28225

GHSA-V8PW-3R2F-3FQM

Affected Products

Manyfold

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28225.json · Exploit
• 🔥 https://github.com/manyfold3d/manyfold/security/advisories/GHSA-v8pw-3r2f-3fqm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-28225 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28225 · Vendor Advisory
• https://github.com/manyfold3d/manyfold/releases/tag/v0.133.1 · Note
• https://twitter.com/CVEnew/status/2027466636320772475 · Twitter Post
• https://t.me/cveNotify/153538 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2027190575477252273 · Twitter Post