Improper input validation in Penguinmod Penguinmod-Backendapi
CVE-2026-47181
PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection vulnerability in the password reset endpoint allows any authenticated user to change the password of an account, leading to full account takeover. An attacker only needs a registered account and a valid password reset token for their own account. This issue has been patched in version 1.0.0.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.003 (16.5th percentile) — read the EPSS interpretation.
Affected products
- Penguinmod Penguinmod-backendapi — versions < 1.0.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)