puemos vulnerabilities

Products

• puemos/craftplan 2

Latest puemos CVEs

Newest publication first

1. CVE-2026-111349 Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL

   Published 2026-10-15

   Medium·CVSS 6.9 EPSS 0.37%

   Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer...

2. CVE-2026-76876 Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

   Published 2026-08-21

   High·CVSS 8.2 EPSS 0.45%

   Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint wi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.