SZB-3cf88bdf11
EUVD-2026-114329 flags unauthenticated endpoint flaw in AdminNeo
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- AdminNeo
- Product
- adminneo
- First seen
Summary
EUVD-2026-114329 describes an input validation flaw in AdminNeo from 4.6.2 through 5.5.0, rated 7.5 (CVSS v3.1). Per the record, the unauthenticated ?script=version endpoint accepts POST data without origin, CSRF, or parameter-type validation.
If you use AdminNeo
Upgrade AdminNeo to version 5.5.0 or later
Restrict access to the AdminNeo login and endpoints by network rule until patched
Review web server logs for unexpected requests to ?script=version
What the sources say 1
· Mastodon: “From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation.” Source