CVE-2026-54047
Laci Synchroni, a decentralized mod and appearance sync server for Dalamud, had a flaw in its OAuth2 login that let users edit a local config file to impersonate any other user. The server failed to verify that the UID in the config matched the authenticated identity, allowing attackers to take over accounts. The issue was fixed in version 1.2.3.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of the Laci Synchroni backend for Dalamud, specifically those running versions earlier than 1.2.3.
Real-world impact
An attacker who can edit the local config file can impersonate any target user, gaining the ability to perform actions on that user's behalf—such as uploading or modifying mods, changing settings, or accessing sensitive data—without needing the target's credentials.
Why this severity
The CVSS score of 9.2 reflects the vulnerability’s high impact: it allows complete impersonation (confidentiality, integrity, and availability are all compromised) with minimal effort and no user interaction. This makes it a critical security risk.
What to do about it
- 01Upgrade the Laci Synchroni backend to version 1.2.3 or later.
- 02Restart the Laci Synchroni service to apply the update.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 11, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.