CVE-2026-129110 is a CVSS 9.8 missing-authentication flaw in sysPass 3.0.1–3.2.11. The install/install handler runs in PARTIAL_INIT — the bootstrap skips the installed-check entirely.

The chain:

  1. POST to install/install — no authentication required
  2. Overwrite config.xml, point the app at an attacker-controlled database
  3. Create an admin account
  4. Plant a serialized PublicLink gadget (phpggc Monolog chain)
  5. AccountController::viewLinkAction() calls unserialize() with no allowed_classes
  6. RCE as the web server user

Why this one matters more than a typical 9.8: the target is a password manager. The vault holds every credential the user decided not to memorize. Compromise sysPass, compromise everything it held.

Fix: 3.2.12. Some sources note upstream may be unmaintained — confirm the fix is available before relying on the version number. If not, remove or block the install directory at the web server and migrate.

PoC: public on GitHub (psylinux/CVE-2026-129110-sysPass) and indexed on Sploitus.

Full write-up with hunt queries and mitigation checklist: https://threataft.com/articles/cve-2026-129110-syspass-unauthenticated-reinstallation-rce