PT-2026-35715 · Mphrx · Minerva

Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-5780

Mitre

CVSS v4.0

8.5

High

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specifically in the endpoint '/minerva/moUser/show/'. If this vulnerability is successfully exploited, an authenticated user can access the data of other registered users simply by modifying the ID. This allows an attacker to obtain a list of users.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-5780

Affected Products

Minerva

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-5780 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-mphrxs-minerva · Note