Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2026-107186

Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rapid7

Description

An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eptura Archibus

Default version status: unaffected

  • 0 to < 2025.02affected

References