CVE-2026-108501

MediumCVSS 5.7/10Last modified Oct 13, 2026

Description

ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-269

Affected software

VendorProductVersions
ZTEZTE Z80 UltraGEN_ZTE_PQ85A01V1.0.0B27 and prior released versions

References

Timeline

Published
Oct 10, 2026
Last modified
Oct 13, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1085023.3ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hookCVE-2026-1085033.3ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access conCVE-2026-1085045.5ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient.CVE-2026-1085053.3ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to oCVE-2026-1085065.5ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call thCVE-2026-1085146.5Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site SCVE-2026-1085156.5Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site SCVE-2026-1085182.9DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an CVE-2026-108527.5IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServerCVE-2026-1085214.7A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file bacCVE-2026-1085228.3A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component LoCVE-2026-1085234.3A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts o
CVE-2026-108501: Medium severity, CVSS 5.7 | Vulnix