← CVE index
Vulnerability record/PUBLISHED/Published Nov 13, 2026 22:15:11 UTC

CVE-2026-129173

A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.0. Affected is the function WorkflowParticipantController.getParticipantDetails of the file app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/WorkflowParticipantController.java of the component Participant Details Endpoint. Performing a manipulation results in insufficient session timeout value. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

Base score6.9/ 10
SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityLowVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
Exploit maturityNot definedE
CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulDB
Last updatedNov 14, 2026 06:32:20 UTC
PublishedNov 13, 2026 22:15:11 UTC
ReservedNov 13, 2026 17:24:24 UTC

Credits

  • Vu Hoang Dat (VNU Information Technology Institute, Vietnam National University, Hanoi)
  • Le Quang Minh (VNU Information Technology Institute, Vietnam National University, Hanoi)
  • Vu Hoang Dat (VulDB User)
  • Vu Hoang Dat (VulDB User)
  • VulDB CNA Team