CVE Intelligence
Analysis AI-assisted

CVE-2026-2174: code-projects Contact Management System 1.0 Improper Authentication in CRUD Endpoint

CVE-2026-2174 is an improper authentication flaw (CWE-287) reported in code-projects Contact Management System 1.0, in an unspecified part of the CRUD Endpoint component. NVD scores it CVSS 3.1 9.8 (Critical) with a network attack vector and no privileges required, while the CNA VulDB reports lower scores under other CVSS versions. No fixed version is listed in the record and the CVE is not in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a flaw classified as CWE-287 (Improper Authentication) in code-projects Contact Management System 1.0. The vulnerable part is an unspecified part of the CRUD Endpoint component, and manipulating the argument ID results in improper authentication. The description states the attack may be launched remotely. The CVE was published on 2026-02-08 by the CNA VulDB and analyzed by NVD.

Impact

NVD assigns a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates network access, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. The CNA VulDB lists other scores (7.3 under CVSS 3.1, 6.9 under CVSS 4.0 and 7.5 under CVSS 2.0), so the rating depends on the metric used.

Because the description says authentication can be bypassed through the ID argument, the practical consequence is that data or functions behind the endpoint may be reachable without valid credentials. The exact data exposed or changed is not described in the record.

Affected products and versions

The description names code-projects Contact Management System 1.0. The structured affected field, however, lists Fabian Contact Management System version 1.0, which does not match the vendor and product name in the description. Organizations should confirm which product and build they run before assessing exposure.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation appears in the sources consulted. The EPSS record shows a probability of 0.00633 and a percentile of 0.48978, as recorded in the data.

Remediation and mitigation

The record lists no fixed version. A missing fixed version does not mean no fix exists, so check the vendor site and the VulDB entry for updates.

  • Restrict network access to the application, especially its administrative and CRUD functions.
  • Place the application behind an authentication layer that is independent of the vulnerable endpoint until a fix is confirmed.
  • Remove or isolate instances that are not required.
  • Review the code paths that handle the ID parameter to confirm that every request is checked for authorization.
  • If the project is no longer maintained, plan a replacement (inference from the absence of any fix in the record).

Detection guidance

  • Review web server and application logs for requests to CRUD endpoints that succeed without a valid session.
  • Alert on unexpected create, read, update or delete activity from unknown addresses.
  • Maintain an inventory of deployments of this software, including version identifiers.

Limitations of the available information

The affected component is described only as an unknown part of the CRUD Endpoint. The product name differs between the description and the affected field. No vendor advisory or fixed version is present in the record, and the CVSS scores come from different providers and versions. The EPSS date in the record (2026-10-13) is later than the publication date and is reported here as recorded.

Frequently asked questions

What is CVE-2026-2174?

It is an improper authentication flaw (CWE-287) reported in code-projects Contact Management System 1.0, affecting an unspecified part of the CRUD Endpoint component.

Is there a fixed version?

The record does not list a fixed version. Check the vendor and the VulDB entry for updates, since a missing entry does not prove no fix exists.

Is this CVE being exploited in the wild?

CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.