CVE-2026-7165: Gaudire Assassin Game: Multiple Input Validation, Authorization and SSRF Flaws in addJugador Endpoint
CVE-2026-7165 is a critical issue (CVSS score 9.4) reported by INCIBE in the /addJugador endpoint of the Assassin game by Gaudire. The record describes weak input validation, missing authorization checks, self-assignable administrative privileges, a denial-of-service condition and server-side request exposure. No fixed versions or affected version ranges appear in the consulted sources, so defenders should rely on the vendor and CERT notice.
Overview
CVE-2026-7165 was published on 2026-06-22 by INCIBE as CNA, with CWE-20 (Improper Input Validation) and a CVSS score of 9.4, rated critical. The record describes several weaknesses in the /addJugador endpoint of a game application. The INCIBE-CERT notice is the main reference in the record and appears to concern the Assassin game by Gaudire, which is an inference from the URL.
Impact
The record reports five related problems:
- Modification of other users' information through the keyJugador and keyJugadorObjectiu parameters, without authorization checks.
- Insertion of arbitrary values in the punts and numObjectiusEliminats fields, which could be used to falsify scores and obtain prizes awarded by city councils.
- Self-assignment of administrative privileges through the tokens field, without server-side validation.
- Denial of service caused by extremely long numeric values that can crash the system and make created games unplayable.
- Server-side requests to arbitrary URLs through the urlImatge parameter, which the record links to internal IP disclosure, access to internal services, local file reading and unauthorized calls to third-party APIs.
The record states that an authenticated attacker could exploit these conditions. Its CVSS vector indicates high impact on confidentiality, integrity and availability.
Affected products and versions
The record does not list affected products or version ranges, and the affected list is empty. The reference slug suggests the product is an Assassin game by Gaudire, but the affected versions are unknown from the sources consulted.
Exploitation status
The CISA KEV catalogue does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. The EPSS score is not available in the record.
Remediation and mitigation
- Check with the vendor or operator of the Gaudire Assassin game whether the version in use is affected, using the INCIBE notice as the starting point.
- Apply any update released by the vendor as soon as it is available. No fixed version is listed in the record.
- Until a fix is confirmed, restrict access to the game's administrative and API functions, limit who can create accounts, and review whether the application is exposed to the internet.
- Limit outbound network access from the application server to internal addresses and unneeded external destinations, which reduces the risk of server-side request abuse.
- Enforce server-side validation of numeric ranges and token-based role checks as a defensive measure if the application is maintained in-house.
Detection guidance
- Review application logs for changes to user records or scores that do not match normal game activity.
- Monitor for unexpected role or permission changes on accounts.
- Watch for unusually large numeric values in game-related requests and for application crashes or restarts.
- Monitor outbound requests from the application server to internal network ranges or unusual external hosts.
Limitations of the available information
The record does not provide affected or fixed versions, vendor details, a patch status, or an EPSS score. The product name is inferred from a reference URL. The consulted sources contain no independent technical validation of the reported conditions.
Frequently asked questions
Is CVE-2026-7165 being actively exploited?
It is not listed in the CISA KEV catalogue, and no confirmed exploitation in the wild appears in the sources consulted.
Which versions are affected and is there a fix?
The record does not list affected or fixed versions. Check the INCIBE notice and the vendor for current information.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.