CVE-2026-2398

HighCVSS 8.8/10Last modified Oct 25, 2026

Description

Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation.

This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-239806.5Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticatedCVE-2026-239814.3An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modifyCVE-2026-239826.5An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creCVE-2026-239836.5A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The TCVE-2026-239846.5An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the readCVE-2026-239856.5A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is loCVE-2026-239867.1Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a projeCVE-2026-239887.0Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condition (TOCTOU) in src/CVE-2026-239898.1REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCVE-2026-23996.1CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause critical files oCVE-2026-239905.3The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. StCVE-2026-239917.5go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or
CVE-2026-2398: High severity, CVSS 8.8 | Vulnix