CVE-2026-33552 Details
Description
Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.
An access control vulnerability has been identified in Northern.tech Mender Enterprise Server versions prior to 4.1.1. This issue arises from a flaw in the role-based access control (RBAC) system, where users could inadvertently gain higher access levels than intended. Specifically, if an administrator assigned different access levels to devices through separate device groups, the user would end up with elevated privileges across both groups, potentially leading to unauthorized management of devices.
Users of Northern.tech Mender Enterprise Server should upgrade to version 4.1.1 or 4.0.2. Detailed upgrade instructions are available in the Mender documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://mender.io/blog/cve-2026-49009-cve-2026-33552-input-sanitization-and-access-control-issues-in-mender-server | [email protected] | AdvisoryBundleRemedyVendor |
| https://Northern.tech | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Northern.tech Mender Enterprise Server | <= 4.1.0 (semver) <= 4.0.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |