CVE-2026-112197 Details

A vulnerability exists in the NoviGest Desktop App's Java RMI service due to insufficient authentication in critical functions. This flaw allows an attacker with network access to invoke remote methods without authentication, potentially leading to the exposure of sensitive credentials and the execution of arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account could be exploited to execute operating system commands on the server, compromising its overall security.

Users are advised to update the NoviGest Desktop App to version 8.0.0-300, in which the vendor has confirmed that this vulnerability has been fixed. In the updated version, remote methods that access data require a validated JWT session token, interfaces that exposed credentials and allowed arbitrary SQL execution have been removed, and the privileges of the PostgreSQL account have been reduced to prevent program execution and access to server files.