CVE-2026-8077

High

Description

Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. The backend lacks authorization controls, leaving security entirely to the frontend. By modifying the binary string in the ‘Permissions’ field of the JSON response, an attacker could escalate privileges and gain full administrative access. This vulnerability allows all restrictions to be bypassed and completely compromises system management.

SeverityHigh

CVSS8.6

Exploit probability—

ProductCashDro 3 Administration Panel

PublishedMay 8, 2026

First seenMay 8, 2026

Weakness typeCWE-862Missing authorization

How to fix

Patches

incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cashdro-3

Affected products

Product	Affected versions	Fixed in
CashDro CashDro 3 Administration Panel	24.01.00.26	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.