{"id":"CVE-2026-107186","aliases":["EUVD-2026-104458","GHSA-fhwf-9fxr-chxq"],"status":"published","title":"Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse","description":"An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00362,"percentile":0.30458,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-10-19T16:32:05Z","modified":"2026-10-20T20:17:13Z","products":[{"vendor":"eptura","product":"archibus"}],"references":[{"url":"https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/","tags":["related"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107186"},{"url":"https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed"},{"url":"https://github.com/advisories/GHSA-fhwf-9fxr-chxq"}],"sources":{"cve":[{"id":"CVE-2026-107186","title":"Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse","description":"An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.","status":"published","published":"2026-10-19T16:32:05.063Z","modified":"2026-10-20T19:30:17.854Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-104458","description":"An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.","status":"published","published":"2026-10-19T16:32:05Z","modified":"2026-10-20T19:30:17Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:59:42.590373Z"}],"ghsa":[{"id":"GHSA-fhwf-9fxr-chxq","title":"An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and...","description":"An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.","status":"published","published":"2026-10-19T18:32:13Z","modified":"2026-10-19T18:32:21Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:13:58.199856Z"}],"nvd":[{"id":"CVE-2026-107186","description":"An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.","status":"published","published":"2026-10-19T17:17:00.827Z","modified":"2026-10-20T20:17:13.233Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:13:00.83844Z"}]}}