Liman MYS CVE-2026-11340

Exploitation requires an authenticated session on Liman MYS at a low privilege level (CVSS PR:L) with network access to the web management interface (AV:N); no user interaction and no elevated privileges are needed beyond that initial foothold. The concrete prerequisite is a valid low-privileged Liman account whose requests reach functionality lacking proper ACL enforcement - the missing-authorization functions themselves. What limits exploitation: the attacker cannot act purely unauthenticated (a credential/account is mandatory), and only versions before release.Master.1107 are vulnerable, so patched instances and deployments with no untrusted low-privilege accounts are not exposed.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H (base 8.3, High) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with high integrity and availability impact but only low confidentiality impact - consistent with a broken-access-control flaw where an authenticated user pivots to privileged actions rather than reading bulk secrets. No EPSS score, KEV entry, or POC was provided in the input, so probabilistic and in-the-wild signals are absent: this is a vendor/CERT-disclosed issue without evidence of active exploitation. The chief real-world gating factor is PR:L - the attacker must already hold a valid low-privileged account on the Liman instance, which meaningfully narrows exposure to environments with multiple or untrusted users. Given a national CERT coordinated the disclosure and a fixed release exists, this is a genuine patch priority for organizations running Liman, but the required foothold makes mass unauthenticated exploitation unlikely.

An attacker who holds or obtains a standard low-privileged Liman MYS account (for example, a limited operator or a compromised staff login) sends crafted requests directly to administrative or restricted endpoints that the UI would normally hide. Because the server does not enforce authorization on those functions, the attacker performs privileged operations - altering configuration or disrupting managed services - achieving high integrity and availability impact without any user interaction. No public POC is referenced, but the low attack complexity makes the flaw straightforward to exercise once account access exists.