CVE-2026-47181: PenguinMod-BackendApi: NoSQL Injection in Password Reset Endpoint Allows Account Takeover

Synopsis

A NoSQL injection vulnerability in the password reset endpoint of PenguinMod-BackendApi allows any authenticated user to take over other accounts. The endpoint is reachable over the network, requires only a low-privilege account plus a valid password reset token for that same account, and no victim interaction is needed. Successful exploitation lets an attacker reset and control any account on the platform. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable password reset endpoint is exposed over the network, so an attacker must be able to reach the service via standard HTTP/S to deliver the injection payload.

• AuthenticationRequired

  The attacker must hold a valid low-privilege registered account and a legitimate password reset token for that account; no anonymous or unauthenticated access path exists.

• Victim interactionNot required

  No action from the targeted account holder is needed; the attacker operates entirely through their own session against the endpoint.

• Attack complexityDetail

  Attack complexity is low, meaning the injection is reliable and requires no special environmental conditions, race windows, or memory layout knowledge to execute.

Blast Radius

• Attacker resets the password of any targeted account, locking the legitimate user out and gaining full session control.
• Attacker reads private account data, stored project files, and any personal information associated with the hijacked account.
• Attacker modifies or deletes content owned by the compromised account, including published projects and profile settings.
• Service availability is marginally degraded (low impact on VA) but the primary harm is full confidentiality and integrity loss on the affected account.