CVE-2026-2254

Published: May 27, 2026Modified: Jul 24, 2026

6.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.8 / Impact: 3.4

Source: security.vulnerabilities@hitachivantara.com (Secondary)

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoints related to platform mail notfications.

Affected (4)

Products: Hitachi: Vantara Pentaho Data Integration And Analytics

Hitachi

1 product

Vantara Pentaho Data Integration And Analytics

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Hitachi Vantara Pentaho Data Integration And Analytics	Before 10.2.0.7
Hitachi Vantara Pentaho Data Integration And Analytics	After 10.2.0.8 to 11.0.0.0
Hitachi Vantara Pentaho Data Integration And Analytics	Version 8.3
Hitachi Vantara Pentaho Data Integration And Analytics	Version 9.3

Related CWEs

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (1)

https://support.pentaho.com/hc/en-us/articles/45676384909069--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-10-2-0-6-and-11-0-0-0-Impacted-CVE-2026-2254?brand_id=1928686

Source: security.vulnerabilities@hitachivantara.com

Vendor Advisory

Timeline

No history available yet.