SharePoint Manager Plus CVE-2026-119682

Requires an authenticated low-privileged user account on a ManageEngine SharePoint Manager Plus instance running build 4506 or earlier, plus network reachability to the application. The specific weakness is missing authorization enforcement (CWE-862) on the MFA configuration functionality, allowing that low-privileged account to read/modify MFA settings, enable or disable MFA application-wide, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Limiting factors: exploitation is NOT possible without valid credentials despite the input vector's PR:N, so exposure depends on who holds accounts; impact is confined to the SPMP application's authentication posture and availability. The only complete fix stated by the vendor is upgrading to build 4507; no other mitigation is described in the available sources.

This is a moderate-priority issue (vuln.today Decision label: this_week) rather than an emergency. The strongest real-world signal is a direct conflict in the input that must be resolved before acting: the supplied CVSS 4.0 vector asserts PR:N (unauthenticated), but the vulnerability description explicitly states that a 'low-privileged authenticated user' performs the exploit (CWE-862, Missing Authorization). These cannot both be true - the flaw is a post-authentication authorization bypass, so the PR:N metric appears incorrect and the real prerequisite is a valid low-privilege account. This materially lowers exploitability versus a true network-unauthenticated bug. No CISA KEV listing, no EPSS score, and no proof-of-concept are present in the input, so there is no evidence of active or at-scale exploitation; the sole reference is a ManageEngine vendor post announcing the fixed build. The supplied CVSS 4.0 impact set (VC:N/VI:L/VA:N with subsequent-system SC:H/SI:H/SA:H) and the 7.9 score reflect that the damage is to the application's authentication posture and availability (MFA can be disabled app-wide, enrolled accounts deleted, legitimate users locked out) rather than data confidentiality. Net: a genuine security-control-weakening and denial-of-service risk for organizations running SharePoint Manager Plus, but gated behind authentication and with no exploitation evidence - prioritize patching this week, not as a same-day emergency.

An attacker who already holds a low-privilege account in SharePoint Manager Plus (for example a compromised or rogue internal user) sends requests to the MFA configuration endpoints, which fail to enforce authorization. They disable MFA for the whole application to weaken authentication, or delete MFA-enrolled accounts and set invalid MFA settings to lock legitimate users out. No public proof-of-concept is identified at time of analysis, though the vendor advisory notes the reproduction was performed against build 4506.