SALTO ProAccess Space CVE-2026-11889

Exploitation requires the ProAccess Space deployment to be running with the tenancy feature / logical partition enabled - that specific configuration IS the precondition; single-tenant installations without logical partitioning are not in scope. The attacker must be an authenticated, authorized user of the platform (CVSS PR:L), so a valid low-privileged tenant account is mandatory, which is the primary factor limiting exploitation. Beyond authentication, no user interaction is needed (UI:N) and complexity is low (AC:L); the attack is network-reachable (AV:N) against the management interface. Impact is limited to integrity (VI:H) with no confidentiality or availability effect per the vector.

The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N, base 7.1 / High) indicates network-reachable, low-complexity exploitation requiring low privileges and no user interaction, with high integrity impact but no confidentiality or availability impact - meaning an attacker can alter/control resources across tenants rather than merely read data or crash the service. PR:L confirms this is an authenticated issue: the attacker must already be a valid, low-privileged user of the platform, which meaningfully limits the exploit population to insiders or holders of compromised tenant accounts. No EPSS score, KEV listing, or POC indicator is present in the input, so there is no evidence of active exploitation or automatable mass abuse; this reads as a real but access-gated integrity/authorization risk rather than an internet-worm-class emergency. For physical-security deployments the integrity impact is notable because manipulating 'spaces' can translate into control over physical door/access decisions. Note the input omits an affected version range and fix version, so patch-based prioritization requires consulting the CISA advisory directly.

An attacker who holds or obtains a legitimate low-privileged operator account for one tenant in a shared ProAccess Space deployment sends crafted requests that reference a partition or space identifier belonging to a different tenant. Because the server trusts the supplied object reference (CWE-639), the request is honored, letting the attacker view or modify access-control configuration for spaces they should not manage. No public exploit code is identified at time of analysis, but the low attack complexity (AC:L) and lack of required user interaction make exploitation straightforward for an authenticated user.