CVE-2026-2693

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability was determined in CoCoTeaNet CyreneAdmin up to 1.3.0. This vulnerability affects unknown code of the file /api/system/dashboard/getCount of the component System Info Endpoint. Executing a manipulation can lead to improper authorization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-266 CWE-285

Affected software

Vendor	Product	Versions
CoCoTeaNet	CyreneAdmin	1.0; 1.1; 1.2; 1.3.0

References

https://vuldb.com/?ctiid.346493Permissions Required, VDB Entry
https://vuldb.com/?id.346493Third Party Advisory, VDB Entry
https://vuldb.com/?submit.754242Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-269307.2SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.CVE-2026-269315.7Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service v CVE-2026-269327.5Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manip CVE-2026-269335.7Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data CVE-2026-269346.5Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cau CVE-2026-269357.5Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Ma CVE-2026-269367.5Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regul CVE-2026-269377.5Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPE CVE-2026-269387.7Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker CVE-2026-269396.5Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configur CVE-2026-26945.4The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capabili CVE-2026-269406.5Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via