CVE-2026-12593 Details
Description
The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so. Precondition for successful exploitation was a preexisting internal user (with more privileges than the attacker), the attacker knowing its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker would then have had to forge a token creation API request on behalf of the other user and could have authenticated and finalized the token creation with their own OAuth/OIDC credentials. In the worst case, this would mean an attacker could have become Dashboard Administrator and been able to perform all administrative actions if the preexisting internal user had administrative privileges. In combination with a separate weakness, this could have further led to code execution on the host system running the Dashboard with the privileges of the OS-User running the Dashboard server.
A missing authorization vulnerability has been identified in an internal, undocumented Dashboard API endpoint used for creating API tokens. This issue affects Axivion versions 7.8.5 to 7.8.12, 7.9.0 to 7.9.12, 7.10.0 to 7.10.10, 7.11.0 to 7.11.6, and 7.12.0 to 7.12.1. The vulnerability arises because the endpoint did not properly verify whether a user had the necessary permissions to create a token for another user. Exploitation requires that the attacker has access to an internal user account with higher privileges, knows the user's login name, and can authenticate via OAuth or OpenID Connect. By forging a token creation request for the other user and using their own OAuth credentials, an attacker could potentially gain administrative rights on the Dashboard, allowing them to perform all administrative actions. Furthermore, this could be exploited in conjunction with another vulnerability to execute arbitrary code on the host system where the Dashboard is running, using the privileges of the operating system user that runs the Dashboard server.
Users can upgrade to Axivion versions 7.9.13, 7.10.11, 7.11.7, or 7.12.2 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-12593 | TQtC | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | TQtC |
Affected Products
| Product | Versions |
|---|---|
| Axivion | >= 7.8.5, <= 7.8.12 (semver) >= 7.9.0, <= 7.9.12 (semver) >= 7.10.0, <= 7.10.10 (semver) >= 7.11.0, <= 7.11.6 (semver) >= 7.12.0, <= 7.12.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | TQtC |