Which versions of Server are affected by CVE-2026-1712?

Organizations using Incorrect privilege assignment vulnerability in HYPR Server should be aware of moderate risk from CVE-2026-1712 rated CVSS 5.8.. A patch is available.

How to fix or mitigate CVE-2026-1712?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Server CVE-2026-1712

Q: What is the CVSS score of CVE-2026-1712?

CVE-2026-1712 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-15483 MEDIUM

Incorrect Privilege Assignment (CWE-266)

2026-03-25 HYPR

GHSA-gwp7-phfm-2677

Privilege Escalation Server

5.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

10.7

EUVD ID Assigned

Mar 25, 2026 - 17:17 euvd

EUVD-2026-15483

Analysis Generated

Mar 25, 2026 - 17:17 vuln.today

CVE Published

Mar 25, 2026 - 16:56 nvd

MEDIUM 5.8

DescriptionCVE.org

Incorrect privilege assignment vulnerability in HYPR Server allows Privilege Escalation.This issue affects HYPR Server: from 10.5.1 before 10.7.

AnalysisAI

An incorrect privilege assignment vulnerability in HYPR Server allows authenticated users to escalate their privileges through an unspecified mechanism. HYPR Server versions 10.5.1 through 10.6.x are affected, with the vulnerability resolved in version 10.7 and later. An attacker with valid user credentials can exploit this flaw to gain elevated permissions, potentially compromising the entire authentication infrastructure managed by the HYPR Server instance.

Technical ContextAI

This vulnerability is rooted in CWE-266 (Incorrect Privilege Assignment), which occurs when a system fails to properly enforce privilege boundaries during user role assignment or privilege escalation logic. The affected product is HYPR Server (cpe:2.3:a:hypr:server:*:*:*:*:*:*:*:*), an identity and access management platform. The flaw exists in the privilege assignment logic between versions 10.5.1 and 10.6.x, indicating a regression or improper validation of user permissions during role or capability assignment. The vulnerability likely stems from insufficient authorization checks in the privilege elevation code path, where the system fails to validate that a user should be permitted to assume elevated roles.

RemediationAI

Upgrade HYPR Server to version 10.7 or later immediately to remediate this vulnerability. The patch is available from HYPR and addresses the incorrect privilege assignment logic. Until patching can be completed, organizations should implement compensating controls by restricting administrative access to HYPR Server's privilege management functions to a minimal set of trusted administrators, enforcing multi-factor authentication for all administrative users, and implementing enhanced audit logging on privilege-related operations to detect suspicious elevation attempts. Access the official security advisory and patch downloads at https://www.hypr.com/trust-center/security-advisories.