HIGH 8.6 NVD

CVE-2026-107186

An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allo

An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.

References

https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-databa

Published: 2026-10-19 · Source: NVD · Feed updated: 2026-10-19

This high severity vulnerability with a CVSS score of 8.6 was published on 2026-10-19 via NVD.

vulnfeed aggregates 17437 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.