Vulnerability Intelligence Report
D-Link D-View 8 IDOR Allows Credential Disclosure and Account Takeover
CVE-2026-23754
D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credential material can be reused directly as a valid authentication secret, allowing full impersonation of the targeted account. This results in complete account takeover and full administrative control over the D-View system.
No Active Exploit Signals
CVSS Base Score
8.7
HIGH
EPSS Probability:0.32%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-639 ↗CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| D-Link | D-View 8 | 0 <= 2.0.1.107 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.319%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-01-15T18:42:20 |
| Published | 2026-01-21T18:02:45 |
| Last Updated | 2026-05-14T02:09:23 |
Community Chatter & Buzz