{"id":"CVE-2026-106133","aliases":["EUVD-2026-123631","GHSA-w8jm-83gh-rh4m"],"status":"published","title":"Incorrect Authorization in Telerik Report Server Web Report Designer","description":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-11-11T17:32:36Z","modified":"2026-11-11T18:31:46Z","products":[{"vendor":"progress software","product":"telerik report server"},{"vendor":"progress software corporation","product":"telerik report server"}],"references":[{"url":"https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-authorization-cve-2026-106133","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106133"},{"url":"https://github.com/advisories/GHSA-w8jm-83gh-rh4m"}],"sources":{"cve":[{"id":"CVE-2026-106133","title":"Incorrect Authorization in Telerik Report Server Web Report Designer","description":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.","status":"published","published":"2026-11-11T17:32:36.189Z","modified":"2026-11-11T17:32:36.189Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-11T18:31:11.5477Z"}],"euvd":[{"id":"EUVD-2026-123631","description":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.","status":"published","published":"2026-11-11T17:32:36Z","modified":"2026-11-11T17:32:36Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-11T20:30:18.561883Z"}],"ghsa":[{"id":"GHSA-w8jm-83gh-rh4m","title":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization...","description":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.","status":"published","published":"2026-11-11T18:31:38Z","modified":"2026-11-11T18:31:46Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-11T18:35:38.720583Z"}],"nvd":[{"id":"CVE-2026-106133","description":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.","status":"published","published":"2026-11-11T18:18:24.023Z","modified":"2026-11-11T18:18:24.023Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-11T19:25:58.374679Z"}]}}