{"id":"CVE-2026-26053","state":"PUBLISHED","title":"An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they","description":"An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10.","publishedAt":"2026-07-07T03:48:47.708Z","updatedAt":"2026-07-07T13:37:52.035Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"Gallagher"},"assigner":"Gallagher","products":["Gallagher Command Centre Server"],"affected":[{"vendor":"Gallagher","product":"Command Centre Server","defaultStatus":"unaffected","versions":[{"version":"9.10","status":"affected","versionType":"custom"},{"version":"9.50","status":"affected","lessThan":"vEL9.50.1587(MR1)","versionType":"custom"},{"version":"9.40","status":"affected","lessThan":"vEL9.40.3130(MR3)","versionType":"custom"},{"version":"9.30","status":"affected","lessThan":"vEL9.30.3983(MR5)","versionType":"custom"},{"version":"9.20","status":"affected","lessThan":"vEL9.20.4349(MR7)","versionType":"custom"}]}],"references":["https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-26053"],"weaknesses":["CWE-266"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/26xxx/CVE-2026-26053.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-26053","state":"PUBLISHED","datePublished":"2026-07-07T03:48:47.708Z","dateUpdated":"2026-07-07T13:37:52.035Z","assignerShortName":"Gallagher","assignerOrgId":"0c426f27-3ee1-4eff-be88-288d5a1822bc","dateReserved":"2026-03-01T23:45:09.665Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10."}],"affected":[{"vendor":"Gallagher","product":"Command Centre Server","defaultStatus":"unaffected","versions":[{"version":"9.10","status":"affected","versionType":"custom"},{"version":"9.50","status":"affected","lessThan":"vEL9.50.1587(MR1)","versionType":"custom"},{"version":"9.40","status":"affected","lessThan":"vEL9.40.3130(MR3)","versionType":"custom"},{"version":"9.30","status":"affected","lessThan":"vEL9.30.3983(MR5)","versionType":"custom"},{"version":"9.20","status":"affected","lessThan":"vEL9.20.4349(MR7)","versionType":"custom"}]}],"references":[{"url":"https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-26053"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":5.3,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-266","lang":"en","description":"CWE-266 Incorrect privilege assignment","type":"CWE"}]}],"providerMetadata":{"shortName":"Gallagher","orgId":"0c426f27-3ee1-4eff-be88-288d5a1822bc","dateUpdated":"2026-07-07T03:48:47.708Z"},"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-07T13:37:41.225293Z","id":"CVE-2026-26053","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-07T13:37:52.035Z"}}]}}}