CVE-2026-94410
4.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-862
Impact
Authenticated low-privileged attackers can enumerate the list of administrative roles over the network. They need valid user credentials to access the unauthorized role list.
Root cause
Missing authorization checks allow standard users to query an endpoint that should be restricted to administrators.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Check advisory VDE-2026-109 for the patched release and upgrade path; interim mitigation is to restrict low-privileged user account access or block network access to the management interface.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.