CVE-2026-21854 | The Tarkov Data Manager is a tool to manage the Tarkov item … | CVSS 9.8 CRITICAL

Description

The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows any unauthenticated user to gain full admin access to the Tarkov Data Manager admin panel by exploiting a JavaScript prototype property access vulnerability, combined with loose equality type coercion. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities.

Metadata

CVE ID: CVE-2026-21854
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-01-05 16:44 UTC
Published: 2026-01-07 18:14 UTC
Last updated: 2026-01-07 18:41 UTC
Primary CWE: CWE-287
CWE-287: Improper Authentication
Vendor / Product: the-hideout / tarkov-data-manager
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
the-hideout	tarkov-data-manager	—	<= 2.0.0

Weakness (CWE)

CWE	Source	Description
CWE-1321	cna	CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-287	cna	CWE-287: Improper Authentication
CWE-843	cna	CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)

https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-r8w6-9xwg-6h73 https://github.com/the-hideout/tarkov-data-manager/security/advisories/GHSA-r8w6-9xwg-6h73
https://github.com/the-hideout/tarkov-data-manager/commit/f188f0abf766cefe3f1b7b4fc6fe9dad3736174a https://github.com/the-hideout/tarkov-data-manager/commit/f188f0abf766cefe3f1b7b4fc6fe9dad3736174a