CVE-2026-21854

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-21854
The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows any unauthenticated user to gain full admin access to the Tarkov Data Manager admin panel by exploiting a JavaScript prototype property access vulnerability, combined with loose equality type coercion. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/the-hideout/tarkov-data-manager/commit/f188f0abf766cefe3f1b7b4fc6fe9dad3736174a Patch
https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-r8w6-9xwg-6h73 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:tarkov:tarkov_data_manager:*:*:*:*:*:*:*:*
History

03 Feb 2026, 16:21

Type Values Removed Values Added
First Time Tarkov tarkov Data Manager
Tarkov
CPE cpe:2.3:a:tarkov:tarkov_data_manager:*:*:*:*:*:*:*:*
References () https://github.com/the-hideout/tarkov-data-manager/commit/f188f0abf766cefe3f1b7b4fc6fe9dad3736174a - () https://github.com/the-hideout/tarkov-data-manager/commit/f188f0abf766cefe3f1b7b4fc6fe9dad3736174a - Patch
References () https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-r8w6-9xwg-6h73 - () https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-r8w6-9xwg-6h73 - Vendor Advisory
Information

Published : 2026-01-07 19:15

Updated : 2026-02-03 16:21

NVD link : CVE-2026-21854

Mitre link : CVE-2026-21854

CVE.ORG link : CVE-2026-21854

JSON object : View

Products Affected

tarkov

  • tarkov_data_manager
CWE
CWE-287

Improper Authentication

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')