MphRx Minerva CVE-2026-5780

Apply patches or upgrades referenced in the INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-mphrxs-minerva-the advisory should specify fixed version numbers or provide vendor patches (not independently confirmed from provided data). Until patching, implement server-side access control checks in the '/minerva/moUser/show/' endpoint to verify the authenticated user's session ID matches the requested user ID parameter before returning data; this requires code-level changes and should be tested to ensure legitimate multi-account admin functions are preserved. Alternatively, deploy web application firewall rules to block requests where the user ID parameter does not match the authenticated session context, though this is complex to implement correctly and may break legitimate administrative access-carefully whitelist admin roles if this approach is used. Enable detailed access logging for the moUser module to detect enumeration attempts (rapid sequential ID requests from single sessions). For high-security environments, consider restricting network access to Minerva's administrative interfaces to trusted IP ranges until vendor patches are applied, reducing the network attack vector to internal threats only.