CVE-2026-42160 Details
Description
Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered "PENDING" organization / user accounts. This issue has been patched in version 7.3.2.
A vulnerability exists in Data Space Portal versions 2.1.1 prior to 7.3.2, allowing self-registered 'PENDING' organization/user accounts to access certain backend API endpoints without proper authorization. This issue arises because the API does not verify the account status of pending users, who can log in and use their session to call relevant endpoints. As a result, pending users can view the dataspace catalog and register connectors, enabling them to participate in the dataspace without approval.
Users can block self-registration by adding a rule to their Caddyfile to respond with a 'Forbidden' status. The long-term solution involves implementing backend checks to ensure that only active users can log in and access API endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sovity/dataspace-portal/security/advisories/GHSA-989g-wpfv-6vxx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/sovity/dataspace-portal/releases/tag/v7.3.2 | [email protected] | Release NotesVendor |
| https://github.com/sovity/dataspace-portal/security/advisories/GHSA-989g-wpfv-6vxx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-602 | Client-Side Enforcement of Server-Side Security | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sovity Data Space Portal | All versions |
CPE
Remediation
| |
| ghcr.io/sovity/ds-portal-ce-backend | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |