EUVD-2026-52759
GHSA-685g-v9jx-pxqq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low complexity; low-privilege authentication required; scope changes as data from unauthorized report scopes is accessed, with confidentiality-only impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.
AnalysisAI
Incorrect authorization in Veeam ONE's shared report link feature permits a low-privileged authenticated user to retrieve report data beyond the intended scope boundary of that link. Exploitation requires a valid Veeam ONE account but no elevated privileges, and the attack is network-accessible with low complexity. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the straightforward exploitation path.
Technical ContextAI
Veeam ONE is an enterprise monitoring, reporting, and analytics platform for Veeam-managed backup and replication infrastructure. The affected product is identified by CPE cpe:2.3:a:veeam:one:*:*:*:*:*:*:*:*, where the wildcard version field indicates all versions are potentially in scope. The root cause is CWE-863 (Incorrect Authorization): the application performs an authorization check when a shared report link is accessed, but the check is implemented incorrectly, allowing a caller to exceed the intended data scope. The shared report link feature is designed to expose a constrained, pre-defined slice of report data; the flaw breaks that scope enforcement. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with subsequent-system confidentiality impact (SC:L) and no vulnerable-system impact (VC:N/VI:N/VA:N) reflects that the attacker crosses an authorization boundary to reach data in another logical scope rather than compromising the application itself.
RemediationAI
Apply the vendor-issued patch documented in Veeam KB4892 (https://www.veeam.com/kb4892). The exact fixed version was not specified in the available intelligence and should be confirmed directly from the advisory before planning upgrades. As a compensating control prior to patching, administrators should audit which accounts have access to the Veeam ONE reporting interface and restrict or revoke low-privileged accounts that do not have a legitimate need to access shared report links. Disabling the shared report link feature entirely in the Veeam ONE configuration will eliminate the attack surface with the trade-off of disrupting any existing automated or manual report-sharing workflows. Additionally, reviewing audit logs for anomalous report data access patterns can help determine whether unauthorized access has already occurred.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information
Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on t
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ON
Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to per
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remo
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remot
Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiri
Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privi
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the n
NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today