PT-2026-29038 · Ddsn Interactive · Acora Cms

Published 2026-03-30 · Updated 2026-03-31 · CVE-2026-29597

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DDSN Interactive Acora CMS version 10.7.1

Description An incorrect access control issue exists in the file details.asp API endpoint of DDSN Interactive Acora CMS version 10.7.1. Attackers with editor privileges can access sensitive files by sending specially crafted requests to this endpoint. The vulnerable endpoint is /file details.asp. The issue allows unauthorized access to files.

Recommendations Apply appropriate access controls to the file details.asp endpoint to restrict access to sensitive files. Ensure that only authorized users with the necessary privileges can access these files.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-29597

Affected Products

Acora Cms

References · 6

• 🔥 https://github.com/padayali-JD/CVE-2026-29597 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29597 · Security Note
• http://acora.com · Note
• https://twitter.com/infoflowcloud/status/2039007138782089431 · Twitter Post
• https://twitter.com/CVEnew/status/2039004533448179931 · Twitter Post
• http://ddsn.com · Note