CVE-2026-89293highCWE-602CWE-862

CVE-2026-89293: high-severity vulnerability in Eclipse Mnestix

Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering

Published

Follow this CVE+ Monitor Eclipse Mnestix

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.5%
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
Eclipse Foundation · Eclipse Mnestix
Related CVEs — Eclipse Mnestix

In the same product, most dangerous first.

CVE-2026-89292CRITICALUnauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured InfrastructuresEPSS 0.5%CVE-2026-89295HIGHUnauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameterEPSS 0.2%