CVE-2026-26367

Katalog CVE

CVSS 8.1 · High EPSS 0,50%

Kerentanan Missing Authorization pada jung-group enet smart home. Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permissions or additional confirmation.

Rincian

Terbit di NVD

15 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 40,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5973.php exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/jung-enet-smart-home-server-arbitrary-user-deletio broken link