What is the CVSS score of CVE-2026-5120?

CVE-2026-5120 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Biovia Workbook are affected by CVE-2026-5120?

Dassault Systèmes BIOVIA Workbook (Release 2021-2026) contains a race condition that allows any authenticated user to access confidential data belonging to other users, creating uncontrolled exposure…

How to fix or mitigate CVE-2026-5120?

Within 24 hours: inventory all BIOVIA Workbook instances (confirm affected releases 2021-2026), enumerate active user accounts, and enable transaction-level audit logging. Within 7 days: restrict Workbook access to essential personnel only, enforce database-level role-based access controls to prevent cross-user reads, and disable any collaborative data-sharing features if operationally feasible. Within 30 days: monitor Dassault Systèmes security advisories for a patch release; evaluate vendor timeline and prepare upgrade or migration strategy to post-2026 releases.

Biovia Workbook CVE-2026-5120

EUVD-2026-40956 HIGH

Race Condition (CWE-362)

2026-07-01 3DS

GHSA-9cqm-4635-4v3j

Authentication Bypass Race Condition Biovia Workbook

8.1

CVSS 3.1 · Vendor: 3DS

Severity by source

Vendor (3DS) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (3DS) · only source for this CVE.

CVSS VectorVendor: 3DS

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 13:20 vuln.today

DescriptionCVE.org

A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user.

AnalysisAI

Unauthorized cross-user data access in Dassault Systèmes BIOVIA Workbook (Release 2021 through Release 2026) stems from a race condition that lets one authenticated low-privilege user read data belonging to another user. Vendor 3DS tags the flaw as an authentication bypass, and its CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L) reflects network-reachable exploitation by any authenticated account with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and no EPSS or KEV signal supplied.