CVE-2026-89293highCWE-602CWE-862

CVE-2026-89293: falha de alta gravidade em Eclipse Mnestix

Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering

Publicada em

Seguir esta CVE+ Monitorar Eclipse Mnestix

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.5%
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
Eclipse Foundation · Eclipse Mnestix
CVEs relacionadas — Eclipse Mnestix

No mesmo produto, das mais perigosas para as menos.

CVE-2026-89292CRITICALUnauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured InfrastructuresEPSS 0.5%CVE-2026-89295HIGHUnauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameterEPSS 0.2%