CVE-2026-40043: Pancho Pachno

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Pachno 1.0.6 contains an authentication bypass vulnerability in the runSwitchUser() action that allows authenticated low-privilege users to escalate privileges by manipulating the original_username cookie. Attackers can set the client-controlled original_username cookie to any value and request a switch to user ID 1 to obtain session tokens or password hashes belonging to administrator accounts.

Affected products

• Pancho Pachno: version 1.0.6 only

Published 2026-04-13. Last modified 2026-06-17.