CVE-2026-86804CWE-266CWE-285

CVE-2026-86804

Medium · published September 8, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. Upgrading to version 1.11.11 is able to resolve this issue. The identifier of the patch is 842eec791377ddcbea5cd639bc065eaa4801d656. It is suggested to upgrade the affected component.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00637 · 49.9th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2026-09-08T23:20Z
References (9)
https://github.com/seakee/CPA-Manager-Plus/ · [email protected]https://github.com/seakee/CPA-Manager-Plus/commit/842eec791377ddcbea5cd639bc065eaa4801d656 · [email protected]https://github.com/seakee/CPA-Manager-Plus/issues/462 · [email protected]https://github.com/seakee/CPA-Manager-Plus/pull/463 · [email protected]https://github.com/seakee/CPA-Manager-Plus/releases/tag/v1.11.11 · [email protected]https://vuldb.com/cve/CVE-2026-86804 · [email protected]https://vuldb.com/submit/911036 · [email protected]https://vuldb.com/vuln/399810 · [email protected]https://vuldb.com/vuln/399810/cti · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 19:00Z
    seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization
    cvelistv5