CVE-2026-111691
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege
CVSS
7.4
Alta
EPSS
0.4%
p35
KEV
—
Exploit Today
11
0-100
Publicado: 16 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-290
0.4%EPSS · 30 dias0.4%
2026-10-172026-11-06
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.
- github.comhttps://github.com/wimoor-erp/wimoor/blob/ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4/wimoor-common/common-mvc/src/main/java/com/wimoor/common/mvc/filter/UserInfoFilter.java#L42-L51
- hackmd.iohttps://hackmd.io/@hieuPenguinnn/wimoor-trusted-x-userinfo-header-tenant-bypass
- www.vulncheck.comhttps://www.vulncheck.com/advisories/wimoor-through-commit-ec86736-authentication-bypass-via-forged-x-userinfo-header
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-191218.3 ALT—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.12hCVE-2026-188389.4 CRÍ—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.12hCVE-2026-172908.5 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts.12hCVE-2026-172789.8 CRÍ—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a trusted party.12hCVE-2026-171728.5 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party.12hCVE-2026-1167909.1 CRÍ27.8%
——8FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryptographically validating its STUN MESSAGE-INTEGRITY attribute. A network peer able to reach an ICE-enabled leg's media port could forge an ICE connectivity check without SDP credentials, nominate its own address, redirect RTP and DTLS traffic, and terminate the legitimate media path. On unencrypted legs this enables eavesdropping and media injection, while all WebRTC and SIP legs that negotiate ICE are in scope. Version 1.11.2 introduces the remediation, which requires ice_verify_message_integrity=true.2d