CVE-2026-42669

Vulnerability

EventPrime versions from n/a through 4.3.2.0 contain a missing authorization vulnerability. This issue stems from incorrectly configured access control, specifically a missing authorization, authentication, or nonce token check within a function. This allows unprivileged users to execute actions typically reserved for higher-privileged users [1].

Exploitation

An attacker needs to be an unprivileged user on the affected system. They can then exploit this vulnerability by triggering a specific function that lacks proper access control checks, allowing them to perform actions they are not authorized to [1].

Impact

Successful exploitation allows an unprivileged user to execute higher-privileged actions. The available references indicate this has a low severity impact and is unlikely to be exploited, though the specific CIA triad outcomes are not detailed [1].

Mitigation

Update EventPrime to version 4.3.2.1 or later to resolve this vulnerability. If an update is not immediately possible, seek assistance from a hosting provider or web developer. Patchstack users can enable auto-updates for vulnerable plugins [1].