CVE-2026-49002

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-490039.6Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and beco CVE-2026-490046.5The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service CVE-2026-490052.4The root password hash of the device can be obtained through unencrypted information in the firmware.CVE-2026-490065.3By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.CVE-2026-490077.5By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web inter CVE-2026-490086.5By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a s CVE-2026-490093.1Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.CVE-2026-49016.5AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further a CVE-2026-490147.8In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It rea CVE-2026-490176.5In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request bo CVE-2026-49028.8A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addressNat of the compon CVE-2026-49038.8A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex of the