{"id":"EM-20261030-WT1X","url":"https://cyber.eventmonitor.net/incident/EM-20261030-WT1X/","type":"cve","title":"Płatnik Vulnerability (CVE-2026-110972)","subtitle":"CVE-2026-110972","subject":"CVE-2026-110972","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-10-30T12:16:34.803Z","firstSignal":"2026-10-30T11:55:00.000Z","lastSignal":"2026-10-30T12:16:34.803Z","updated":"2026-11-04T14:43:58.877Z","revision":1,"life":[{"status":"Born","at":"2026-10-30T12:16:34.803Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-10-30T12:16:34.803Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-10-30T11:55:00.000Z","what":"First signal: C17 CERT Polska"},{"at":"2026-10-30T12:16:34.803Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261030-WT1X created."},{"at":"2026-10-30T12:16:34.803Z","what":"Severity raised to High by C6"}],"stages":[{"name":"Disclosed","at":"2026-10-30T12:16:34.803Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-30T12:16:34.803Z","detail":"CVSS 8.6 · EPSS 0.2%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":"2026-10-30T11:55:00.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-10-30T11:55:00.000Z","source":"C17","sourceName":"CERT Polska","role":"Government","severity":2,"title":"Vulnerabilities in Płatnik software","text":"CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-110970 to CVE-2026-110972) found in Płatnik software.","url":"https://cert.pl/en/posts/2026/10/CVE-2026-110970/"},{"at":"2026-10-30T12:16:34.803Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-110972 (CVSS 8.6)","text":"Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.\n\n\n\nThis issue was fixed in metric 334 in version 10.02.002.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110972"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-30T12:16:34.803","score":8.6,"severity":"HIGH","desc":"Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.\n\n\n\nThis issue was fixed in metric 334 in version 10.02.002.","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00205,"pct":0.1052,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}