What is the CVSS score of CVE-2026-26053?

CVE-2026-26053 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Command Centre Server CVE-2026-26053

EUVD-2026-42000 MEDIUM

Incorrect Privilege Assignment (CWE-266)

2026-07-07 Gallagher

GHSA-j55v-w58w-8mxc

Information Disclosure Command Centre Server Gallagher

5.3

CVSS 3.1 · Vendor: Gallagher

Severity by source

Vendor (Gallagher) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

Requires authenticated low-privilege operator account (PR:L) and specific complex conditions (AC:H); only server-side integrity is impacted with no confidentiality or availability consequence.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Gallagher).

CVSS VectorVendor: Gallagher

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 05:19 vuln.today

DescriptionCVE.org

An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10.

AnalysisAI

Incorrect privilege assignment in Gallagher Command Centre Server permits an authenticated low-privilege operator to execute operations restricted to higher-privilege roles, enabling unauthorized integrity impacts on physical security configurations. Affected versions span the 9.10 through 9.50 release lines, with patches available for 9.20-9.50 but no fix for the fully end-of-support 9.10 branch. No public exploit code exists and this vulnerability is not listed in CISA KEV; it was disclosed directly by the vendor Gallagher.

Technical ContextAI

Gallagher Command Centre Server is an enterprise physical security management platform governing access control, alarm management, and cardholder administration across sites. CWE-266 (Incorrect Privilege Assignment) describes a server-side authorization flaw where the access control logic fails to correctly enforce role boundaries, allowing a principal assigned to a constrained operator role to invoke privileged server-side operations. The CVSS vector AV:N/AC:H/PR:L/UI:N/S:U indicates the flaw is reachable over the network but requires a pre-authenticated low-privilege session and high-complexity conditions - likely specific API call sequences, role configurations, or state prerequisites not fully disclosed in the advisory. The affected CPE is cpe:2.3:a:gallagher:command_centre_server:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patches are available: upgrade to vEL9.50.1587(MR1) on the 9.50 branch, vEL9.40.3130(MR3) on 9.40, vEL9.30.3983(MR5) on 9.30, or vEL9.20.4349(MR7) on 9.20, as confirmed in the Gallagher advisory at https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-26053. Version 9.10 has no patch available in that branch; organizations running 9.10 should plan an urgent upgrade to a supported and patched release line. As a compensating control prior to patching, audit all operator accounts and revoke any low-privilege roles that are not operationally necessary, reducing the pool of principals capable of triggering the flaw. Restricting network access to the Command Centre Server management interface to trusted administrative segments would raise the effective barrier given the AC:H requirement, though it does not eliminate the vulnerability.