CVE-2026-5652: Craftycontrol Crafty Controller

Critical severity, CVSS 9.0. EPSS: 0.5% chance of exploitation in the next 30 days.

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.

Affected products

• Craftycontrol Crafty Controller: before 4.10.4 (fixed in 4.10.4)

Published 2026-04-21. Last modified 2026-06-17.