CVE-2026-89293 Details
Description
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.
A vulnerability exists in Eclipse Mnestix Browser versions 1.2.0 prior to 2.3.0, allowing unauthenticated attackers to perform actions reserved for authorized users. This includes modifying Infrastructure settings and interacting with the authenticated Mnestix AAS Generator backend. The issue arises from a lack of proper authorization checks on the server side, particularly for admin-only actions and the '/api/mnestixConnections' endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.eclipse.org/security/cve-assignment/-/work_items/301 | [email protected] | Issue TrackingVendor |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/772 | [email protected] | Technical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-602 | Client-Side Enforcement of Server-Side Security | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eclipse Mnestix Browser | >= 1.2.0, < 2.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |