CVE-2026-114361

MediumCVSS 5.6/10Last modified Oct 23, 2026

Description

A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266 CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1143626.3A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets T CVE-2026-114377.3A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the co CVE-2026-1143703.7A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files fro CVE-2026-1143744.3A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metada CVE-2026-1143756.3A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/CVE-2026-1143766.3A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHand CVE-2026-1143773.8A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of t CVE-2026-1143786.3A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. T CVE-2026-1143795.4A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packag CVE-2026-114386.3A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /pro CVE-2026-1143806.3A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Per CVE-2026-1143816.3A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /ord