CVE-2026-109849: CVE-2026-109849: güvenlik açığı

Açıklama (NVD)

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.

Özet bilgiler

CVSS v3.1

6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v4.0

7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

%0,18 (yüzdelik 8)

CWE

CWE-266

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• jvn.jp
• www.hinemos.info
• CWE-266