CVE-2026-107186
CVE-2026-107186 · Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.
CVSS 8.6 · High · EPSS 0.4% · Public exploit · Fix available
- Published
- Updated
Affected products and versions
archibus
- Versions
- ≥ 0, < 2025.02: Affected (semver)
Update to 2025.02