Badaso File API Permission Bypass Vulnerability

A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-19376 is a permission bypass vulnerability in Uasoft Badaso 3.0.0-alpha's File API component that allows attackers to manipulate the ApiRequest class through the api.php routes file. With a CVSS score of 7.3 and rooted in improper access control (CWE-266, CWE-275), this vulnerability enables remote attackers to circumvent authorization checks and perform unauthorized file operations. Organizations using Badaso for API-driven file management are directly affected, particularly those in development or early deployment phases who may not have security hardening in place. The public disclosure and lack of vendor response elevate the risk, making this a critical concern for any system relying on this component for secure file handling.

Casky's 224 mapped skills detect the attack patterns associated with this vulnerability by analyzing techniques under TA0004 (Privilege Escalation). When Claude AI performs extended reasoning across these skills, practitioners will identify suspicious patterns such as: unauthenticated or under-authenticated API requests to /api routes modifying file permissions, lateral privilege escalation attempts through the ApiRequest class, and unauthorized access to protected file operations. The detection framework flags deviations from expected authorization flows, abnormal permission modifications without proper credential validation, and API calls that bypass standard authentication middleware. Security teams using Casky will see findings highlighting which API endpoints lack proper authorization gates, enabling them to patch or implement compensating controls before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-19376.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-19376

Casky has 224 skills that investigate the attack patterns behind CVE-2026-19376. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn