HIGHCVSS v3.1 8.5Vulnerability
CVE-2026-107187
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Epss score
- 0.00275
- Cvss severity
- HIGH
- Cvss score
- 8.5
- Retrieved at
- 2026-10-21T01:24:48+00:00
- Last source
- FIRST EPSS
- Score
- 8.5
- Cvss version
- 3.1
- Cve id
- CVE-2026-107187
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- First seen by Signal
- 2026-10-19T19:31:52+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- Published at
- 2026-10-19T17:17:00.967
- Last modified
- 2026-10-20T20:17:13.357
- Epss percentile
- 0.18669
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph