CVE-2026-103903

An incorrect authorization vulnerability in the WinBox

authentication flow of MikroTik RouterOS allows a remote authenticated attacker

with credentials for a low-privilege account permitted to use WinBox to obtain

the authorization policy of a different existing account. The stage-one EC-SRP

challenge and proof are verified using the attacker's account, while the

independently supplied stage-two username is used to install the target

account's privileges. By specifying a higher-privilege account such as admin, a

low-privilege user can obtain a full administrative session without knowing the

target account's password and can use that session to increase the privileges

of the attacker's own account.