CVE-2026-4171

MEDIUM

A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionality of the file examples/lambda-function-url/packages/ap...

Affects 0 products across 2 vendors.

CVSS 3.16.3
CVSS v42.1
EPSS0.4%
Percentile30th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component.
CWE Weakness Definitions
CWE-285: CWE-285
CWE-639: Authorization Bypass Through User-Controlled Key (IDOR)

Software uses a user-supplied key to access resources without verifying authorization for that specific resource.

Related Attack Patterns (CAPEC)
CAPEC-5 Blue Boxing
via CWE-285
CAPEC-13 Subverting Environment Variable Values
via CWE-285
CAPEC-45 Buffer Overflow via Symbolic Links
via CWE-285
CAPEC-51 Poison Web Service Registry
via CWE-285
CAPEC-59 Session Credential Falsification through Prediction
via CWE-285
Show all 17

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A security vulnerability in CodeGenieApp serverless-express up to version 4.17.1 allows for authorization bypass through manipulation of the userId argument in the TodoList.ts file, affecting the API Endpoint component.

BSID: BS-2026-GLOBAL-153738-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-4171?
A security vulnerability in CodeGenieApp serverless-express up to version 4.17.1 allows for authorization bypass through manipulation of the userId argument in the TodoList.ts file, affecting the API Endpoint component.
What is the CVSS score for CVE-2026-4171?
CVE-2026-4171 has CVSS 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS: 0.4%.
Is CVE-2026-4171 actively exploited?
No confirmed active exploitation of CVE-2026-4171 as of 2026-09-25.
How do I remediate CVE-2026-4171?
Priority: HIGH.
What systems are affected by CVE-2026-4171?
CVE-2026-4171 affects Express; Serverless.
Vulnerability Details
CVE IDCVE-2026-4171
BSIDBS-2026-GLOBAL-153738-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Published2026-03-16
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-285Authorization Bypass Through User-Controlled Key (IDOR)
SourceNVD
Official Description

A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionality of the file examples/lambda-function-url/packages/api/models/TodoList.ts of the component API Endpoint. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability can be exploited remotely by manipulating the userId argument in the TodoList.ts file, leading to unauthorized access to functionalities that should be restricted.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Express — —
Serverless — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 213 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash7f397c5452d567e16b0b62c2d236ccf4329d3ec9c9f63ac21630be9a57a09de4450e782a3b5effceabafd9c6af48f550a78da39185267f77beace9b6c6651ffb
Related CVEs affecting Express
CVE-2024-2876 9.8 The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Auto... CVE-2026-37281 9.8 An OS command injection vulnerability in the /stream-to-vlc Express route in ... CVE-2025-24664 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... CVE-2025-27268 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... CVE-2025-24667 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje...
View all Express CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →