CVE-2026-30760: An issue in SourceBans Material Admin before v

Synopsis

An improper input validation or access-control flaw in SourceBans Material Admin (before commit 3ecd95e, version 1.1.6) lets a remote attacker send a crafted XAJAX request to manipulate arbitrary user data in the web application. The vulnerability is reachable over the network, requires no authentication, and no victim interaction. Successful exploitation gives the attacker read, write, and limited denial-of-service capability over application data. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable XAJAX endpoint is exposed over the network, so the attacker must be able to reach the web application via HTTP/HTTPS.

• AuthenticationNot required

  No account or session credentials are needed; the crafted XAJAX request can be sent by any unauthenticated caller.

• Victim interactionNot required

  The attack is entirely server-side; no user needs to click a link or take any action for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• The attacker can read application user data, including any profile fields, roles, or stored records accessible through the XAJAX interface.
• The attacker can write or overwrite arbitrary user records in the web application, such as modifying bans, permissions, or account details.
• The attacker can cause limited disruption to application data integrity, potentially corrupting records in ways that degrade normal operation.