CVE-2026-120113

MediumCVSS 6.4/10Last modified Nov 12, 2026

Description

IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
IBM	Aspera Connect	>= 1.6.1, <= 4.2.19

References

https://www.ibm.com/support/pages/node/7295714

Timeline

Published: Nov 8, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1201147.2The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'm CVE-2026-1201156.3IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who con CVE-2026-120128.1Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position to potentially explo CVE-2026-1201358.2Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recomm CVE-2026-1201398.8Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system CVE-2026-120148.3Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a sa CVE-2026-1201418.8Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system u CVE-2026-1201428.8Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running CVE-2026-1201438.8Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the d CVE-2026-1201448.8Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system CVE-2026-1201458.8Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system use CVE-2026-1201464.3Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It al