CVE-2026-35552

Published: Jul 8, 2026Modified: Jul 9, 2026Deferred

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's license.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://caxperts.com

Source: cve@mitre.org

https://github.com/caxperts/security-advisories/blob/main/2026/CAXSEC-2026-001_portal.md

Source: cve@mitre.org

Timeline

No history available yet.