Skip to content
Heist/ feed
Medium

Privilege Escalation in multiple BinSoft products

Type: advisorySource: Official CVE List1 source record

Multiple BinSoft products are vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application’s memory by inspecting the running process. While ability to retrieve credentials from memory is the expected behavior, the exposed credentials grant administrative access to the database, exceeding the privileges required for normal application functionality. This allows an attacker to perform actions beyond those permitted through the application interface. The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.

Announced Source revision 1
Original source ↗

CVE-2026-40550

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-40550

mpGabinet

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpFirma

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpFaktura

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpFirma ERP

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpSekretariat

Source reference: /containers/cna/affected/4/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpPOS

Source reference: /containers/cna/affected/5/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpCRM

Source reference: /containers/cna/affected/6/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpWarsztat

Source reference: /containers/cna/affected/7/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "BinSoft",
    "product": "mpGabinet",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "23.12.19"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpFirma",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "26.4.9"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpFaktura",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "26.4.9"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpFirma ERP",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "26.4.9"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpSekretariat",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "25.2.4"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpPOS",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "25.2.4"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpCRM",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "25.2.4"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpWarsztat",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "20.4.28"
      }
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-40550

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#4179 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement