DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| drEryk | drEryk Gabinet | unaffected |
|
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 10 Sep 2026 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets. | |
| Title | Use of Hard-coded Credentials in drEryk Gabinet | |
| First Time appeared |
Dreryk
Dreryk dreryk Gabinet |
|
| Weaknesses | CWE-798 | |
| CPEs | cpe:2.3:a:dreryk:dreryk_gabinet:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Dreryk
Dreryk dreryk Gabinet |
|
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2026-09-10T12:43:41.758Z
Reserved: 2026-07-24T12:30:14.525Z
Link: CVE-2026-17038
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses