Which versions of Chiline Cloud are affected by CVE-2026-19424?

Chiline Cloud versions 4.5.9 and earlier (Inventec Appliances) contain a security flaw allowing unauthenticated remote attackers to access arbitrary customer account data.

How to fix or mitigate CVE-2026-19424?

Within 24 hours, determine deployment scope across infrastructure and quantify exposed customer accounts; prepare breach notification and customer communication. Within 7 days, deploy network access restrictions or WAF rules to limit exposure, implement enhanced logging on affected endpoints, and notify impacted customers per regulatory requirements. Within 30 days, monitor vendor channels for a patch release, evaluate upgrade feasibility, and conduct an authorization control audit across account-access mechanisms.

Chiline Cloud CVE-2026-19424

Q: What is the CVSS score of CVE-2026-19424?

CVE-2026-19424 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-55925 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-11 twcert

GHSA-96wg-xpx4-3h59

Authentication Bypass Information Disclosure Chiline Cloud

8.7

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-accessible IDOR with no authentication or user interaction; only confidentiality is impacted as the vulnerability permits read-only unauthorized data access.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 03:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 03:22 vuln.today

cvss_changed

CVSS changed

Aug 11, 2026 - 03:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Aug 11, 2026 - 02:51 vuln.today

CVE Published

Aug 11, 2026 - 01:56 cve.org

HIGH 7.5

DescriptionCVE.org

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data.

AnalysisAI

Insecure Direct Object Reference in Chiline Cloud (Inventec Appliances) versions up to and including 4.5.9 exposes sensitive user data to unauthenticated remote attackers. By manipulating a specific request parameter - likely a user identifier or resource key - an attacker can bypass authorization checks and read account data belonging to arbitrary other users. Reported by TWCERT and catalogued under EUVD-2026-55925, no public exploit code or active exploitation has been confirmed at time of analysis, though the trivial exploitation conditions (network-accessible, no authentication, no user interaction) make this a high-priority disclosure risk.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the application uses a user-supplied value - such as a numeric account ID or object reference - to locate and return a resource without verifying that the requesting party is authorized to access that specific object. Chiline Cloud is a cloud-connected platform developed by Inventec Appliances (CPE: cpe:2.3:a:inventec_appliances:chiline_cloud:*:*:*:*:*:*:*:*), a Taiwanese electronics and IoT manufacturer. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) confirms the vulnerability is exploitable over the network with no authentication, no complexity barriers, and no attack target requirements, resulting in high confidentiality impact to the vulnerable system with no integrity or availability consequences.

RemediationAI

The primary remediation is to upgrade Chiline Cloud to a version beyond 4.5.9; however, no specific patched version number is independently confirmed in the available data - consult the vendor advisory at https://www.twcert.org.tw/en/cp-139-11097-ee412-2.html for the official fix version once published. As a compensating control while a patch is obtained, restrict access to the Chiline Cloud platform at the network perimeter - particularly any API endpoints that accept user-scoped object identifiers - to trusted IP ranges or authenticated VPN sessions only; this reduces the unauthenticated attack surface at the cost of limiting remote usability. Additionally, enable logging on all API object-reference calls to detect enumeration attempts, and review access logs for anomalous patterns of cross-user data retrieval. No patch version is independently confirmed from current input data.