CVE-2026-90820CWE-862CWE-863broken-access-control

CVE-2026-90820

Medium · published September 15, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
32.5
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such manipulation leads to missing authorization. The attack can be launched remotely. Upgrading to version 1.3.0 is sufficient to resolve this issue. The name of the patch is e9a1abf9c90c02b16d17293afdc3cc2f555d63a6. The affected component should be upgraded.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00394 · 32.5th percentile
Weaknesses
CWE-862 · Missing Authorization; CWE-863 · Incorrect Authorization
Published
2026-09-15T01:17Z
References (8)
https://github.com/a2aproject/a2a-java/ · [email protected]https://github.com/a2aproject/a2a-java/commit/e9a1abf9c90c02b16d17293afdc3cc2f555d63a6 · [email protected]https://github.com/a2aproject/a2a-java/pull/1038 · [email protected]https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final · [email protected]https://vuldb.com/cve/CVE-2026-90820 · [email protected]https://vuldb.com/submit/925152 · [email protected]https://vuldb.com/vuln/403323 · [email protected]https://vuldb.com/vuln/403323/cti · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 20:45Z
    a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization
    cvelistv5