VulnerabilityDeferred

CVE-2026-17038

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component.

MEDIUM 6.9EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.26% probability · 18th percentile
CISA KEV: Not listed
Weakness: CWE-798
Source: cvd@cert.pl

References

https://cert.pl/posts/2026/09/CVE-2026-17038
https://dreryk.pl/produkty/gabinet/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.