CVE-2024-57726
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions.
Critical
Known exploited
- Severity
- 9.9 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 66.41%
- Chance of exploitation in the next 30 days. Higher than 99.28% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Apr 24, 2026
- Weakness
- CWE-862 Missing Authorization
- Fix
- None yet
- No fixed version published
Exploited in the wild. SimpleHelp Missing Authorization Vulnerability (SimpleHelp SimpleHelp). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by May 8, 2026. Known to be used in ransomware campaigns.
Description
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it
- Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
- Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
- System Configuration, Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
References
Advisories
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5849-834g-hvw5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search | High | Same weakness, |
| GHSA-cggf-277g-3q54 pypdf has possible large memory usage when parsing page tree | High | Same weakness, |
| GHSA-mfr5-77xh-9j7h pypdf has possible infinite loop when cloning dictionaries | High | Same weakness, |
| GHSA-3g3m-2fjr-6pw4 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal | Medium | Same weakness, |
| GHSA-42gh-23hr-vphw pypdf has possible long runtimes when retrieving page labels | High | Same weakness, |
| GHSA-4vqv-7265-gm2w pypdf has possible large memory usage for exceptions in strict mode | High | Same weakness, |
| GHSA-62m5-6wh8-28x7 pypdf has possible long runtimes/large memory usage for encrypted PDF files | High | Same weakness, |
| GHSA-2qm8-x737-gmw5 pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding | High | Same weakness, |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor