CVE-2026-17038: DrEryk Gabinet before 11.5.0 uses hard-coded API

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets.

• EPSS 0.4% (36.6% percentile)
• CVSS 6.9 medium

Related briefings

• KAMSOFT library flaw lets attackers spy on app traffic 2026-11-06
• Bank's payment plugin lets shop staff rewrite the database 2026-09-14
• Polish medical software shipped hard-coded API logins 2026-09-10

Browse the CVE database

Read the full analysis on IntelFusions