CVE-2026-102298
7.5HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-639, CWE-862
Impact
Authenticated attackers with high privileges can enumerate users, verify account passwords, and gain unauthorized access to MSP resources. They need network access to the controller and a valid account to hit the vulnerable endpoint.
Root cause
The user-confirmation endpoint in MSP mode fails to enforce authorization checks on a caller-supplied identifier parameter.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Omada Controller to the latest version via the vendor support portal; as an interim measure, disable MSP mode or restrict administrative access to trusted management networks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.