EUVD-2026-30930
GHSA-j7p7-w7pr-mwpc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EA account
-
DeliveryConnect to Pro Cloud Server
-
ExploitAttach debugger to EA client
-
ExecutionBypass client-side role check
-
PersistRe-authenticate as administrator
-
ImpactModify or exfiltrate repository contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Use of client-side authentication
|
| Exploitation Conditions | The attacker must hold valid credentials for the Enterprise Architect repository (CVSS PR:L) and must be able to run a modified or debugger-attached EA client against the target server, which means the Sparx repository/Pro Cloud Server endpoint must be reachable from the attacker's host (AV:N). The vulnerability is rooted in the EA client enforcing role restrictions locally (CWE-603), so any deployment that relies on the client to gate user actions - i.e., the default architecture - is exposed; no special non-default feature toggle is required. Limiting factors: unauthenticated attackers cannot exploit this, no user interaction by another user is needed (UI:N), and confirmation is currently limited to versions ≤17.1 - newer versions may or may not still be vulnerable. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) supports a base score of 8.7 - network reachable, low complexity, only low privileges required, no user interaction, and high impact across confidentiality, integrity, and availability of the vulnerable repository. There is no CISA KEV listing and no EPSS score provided in the input, and no public exploit identified at time of analysis, though CERT-PL and third-party blog write-ups (sploit.tech, efigo.pl) exist and could lower the practical exploitation bar. The risk is meaningful but bounded by the PR:L precondition: an attacker needs an existing valid (even read-only) account, which makes this a high-impact insider/lateral-movement issue rather than an internet-wide mass-exploitation risk. A key uncertainty is the version range: the researcher only tested 17.1 and below, and the vendor did not confirm a fixed version, so the upper bound is unverified. |
| Exploit ScenarioDerived | A contractor or junior modeler given a low-privilege Enterprise Architect account attaches a debugger to the EA client, patches the in-process role/identity check, and re-authenticates to the Pro Cloud Server as the repository administrator. From there they exfiltrate sensitive architecture documentation, tamper with diagrams or model elements relied upon by downstream teams, or delete the repository. Third-party technical write-ups exist (sploit.tech, efigo.pl) but no weaponized exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 19, 2026
Privilege escalation in Sparx Enterprise Architect 17.1 and earlier allows an authenticated low-privilege user to impersonate any other user, including administrators, by tampering with the client-side application (e.g., via a debugger). Because role-based access enforcement happens in the client rather than on the server (CWE-603), an attacker who has any valid login can gain full repository control. No public exploit identified at time of analysis, although technical write-ups are referenced.
RemediationAI
No vendor-released patch identified at time of analysis - Sparx Systems did not respond to CERT-PL's disclosure, so no fixed version can be cited. Defenders should monitor https://sparxsystems.com/products/ea/ and the CERT-PL advisory at https://cert.pl/en/posts/2026/05/CVE-2026-42096 for an updated build, and review the technical write-ups at https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html and https://efigo.pl/blog/CVE-2026-42096/ for detection guidance. Compensating controls: restrict EA repository access to trusted users only and remove unneeded accounts, since any authenticated user can escalate (trade-off: limits collaboration); place the Pro Cloud Server behind a VPN or IP allowlist so the network-reachable backend is not exposed to untrusted networks (trade-off: breaks remote modeler workflows); enable verbose audit logging on the EA repository database and alert on role/permission changes and out-of-pattern administrative actions (trade-off: detection only, not prevention); where feasible, set the repository to read-only and require out-of-band review for changes until a patched version ships.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Sparx Enterprise Architect is a widely deployed UML/SysML modeling and architecture tool used for enterprise repositories, often running in a client-server (Pro Cloud Server / PCS) configuration. The underlying weakness is CWE-603 (Use of Client-Side Authentication), meaning role and identity decisions are enforced inside the fat-client EA process rather than authoritatively on the server. The CPE cpe:2.3:a:sparx_systems:enterprise_architect:*:*:*:*:*:*:*:* indicates all editions are in scope, and an attacker manipulating the running client (debugger, memory patching, or protocol replay) can override the role checks and assume any account's identity when interacting with the repository backend.
Know when Enterprise Architect gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (CERT-PL) · only source for this CVE.
CVSS VectorVendor: CERT-PL
DescriptionCVE.org
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior (e.g. using a debugger) and log in as any other user or administrator - then it is possible to do every possible change to the repository.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 17.1 and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Executive ViewAI
Sparx Enterprise Architect 17.1 and earlier contains a critical privilege escalation vulnerability allowing any authenticated user to bypass access controls and become an administrator; no public exploit identified at time of analysis. This leaves enterprise architecture repositories vulnerable to modification or deletion of sensitive design documentation by insiders or others with valid credentials. Leadership must treat this as a high-priority security incident requiring immediate remediation to prevent loss of business-critical architecture data.
No vendor-released patch identified at time of analysis. Implement interim mitigations: restrict network access via VPN or IP allowlisting, enable comprehensive audit logging of administrative activities to detect unauthorized impersonation, and restrict database write access to dedicated service accounts. Escalate to vendor for security patch timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB