CVE-2026-8752

Katalog CVE

CVSS 5.3 · Medium EPSS 0,54%

Kerentanan Incorrect Privilege Assignment pada h2o. Skor CVSS 3.1 5.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java of the component Rapids setproperty Primitive Handler. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

17 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-284: Improper Access Control

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 44,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/submit/810108 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/364379 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/364379/cti permissions required · vdb entry
• https://vulnplus-note.wetolink.com/share/pyVa0GWPuAZE broken link