HIGH 8.5 NVD

CVE-2026-107187

A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulne

A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.

References

https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-databa

Published: 2026-10-19 · Source: NVD · Feed updated: 2026-10-19

This high severity vulnerability with a CVSS score of 8.5 was published on 2026-10-19 via NVD.

vulnfeed aggregates 17437 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.