{"id":"CVE-2026-48136","aliases":["EUVD-2026-31823","GHSA-729m-hm3g-pgc3"],"status":"published","title":"Authenticated Administrator Role-Based Access Control Bypass in Compliance","description":"When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where the administrator has no access permissions, bypassing Role-Based Access Control (RBAC).","severity":{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03732,"percentile":0.89906,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-05-26T12:57:29Z","modified":"2026-07-20T20:10:00Z","products":[{"vendor":"checkpoint","product":"quantum security management"}],"references":[{"url":"https://support.checkpoint.com/results/sk/sk184992"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48136"},{"url":"https://github.com/advisories/GHSA-729m-hm3g-pgc3"}],"sources":{"cve":[{"id":"CVE-2026-48136","title":"Authenticated Administrator Role-Based Access Control Bypass in Compliance","description":"When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where the administrator has no access permissions, bypassing Role-Based Access Control (RBAC).","status":"published","published":"2026-05-26T12:57:29.298Z","modified":"2026-06-02T14:17:00.827Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-31823","description":"When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where the administrator has no access permissions, bypassing Role-Based Access Control (RBAC).","status":"published","published":"2026-05-26T12:57:29Z","modified":"2026-06-02T14:17:00Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:56.59039Z"}],"ghsa":[{"id":"GHSA-729m-hm3g-pgc3","title":"When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator...","description":"When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where the administrator has no access permissions, bypassing Role-Based Access Control (RBAC).","status":"published","published":"2026-05-26T15:32:10Z","modified":"2026-05-26T15:32:16Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:08:18.132911Z"}],"nvd":[{"id":"CVE-2026-48136","description":"When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where the administrator has no access permissions, bypassing Role-Based Access Control (RBAC).","status":"published","published":"2026-05-26T14:16:39.13Z","modified":"2026-07-20T20:10:00.11Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:20.131508Z"}]}}