CVE-2026-33518

HighCVSS 7.2/10Last modified Oct 26, 2026

Description

An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

VendorProductVersions
EsriPortal for ArcGIS11.5

References

Timeline

Published
Apr 21, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-335199.8An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not CVE-2026-33527.2The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0.4 via the `update_wCVE-2026-335206.1There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenCVE-2026-335217.5There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker tCVE-2026-335225.3Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata. A patch is provided for CVE-2026-335236.5HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affeCVE-2026-335247.5Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payloadCVE-2026-335256.1Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applicatCVE-2026-335267.5Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handliCVE-2026-335274.3Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-aCVE-2026-335286.5GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at `/api/v1/fiCVE-2026-335298.8Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in