EUVD-2026-55081
GHSA-m4x6-wx7h-hwvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-accessible Tegalog login endpoint
-
ExploitCraft input matching permissive authentication regex
-
ExecutionBypass management console authentication
-
ImpactExercise full admin console operations
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Permissive regular expression
|
| Exploitation Conditions | The Tegalog management console login endpoint must be network-reachable by the attacker. The CVSS 4.0 vector (PR:N, AC:L, AT:N, UI:N) confirms no prior authentication, no elevated privileges, no special attack prerequisites, and no user interaction are needed. The entire exploitation surface is the login form itself - no non-default configuration, plugin, or feature flag is required. The sole limiting factor is network reachability: installations not exposed beyond a trusted internal network or VPN are substantially less at risk. Any Internet-facing Tegalog deployment is directly exploitable without additional preconditions. |
| Impact | The CVSS 4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L) accurately reflects the low-friction, unauthenticated, network-exploitable nature of the bypass with high integrity impact on the vulnerable system. No privileges are required and no user interaction is involved, placing this at a very low bar for exploitation. That said, the product is a niche CGI memo logger with a small, predominantly Japanese deployment footprint, which substantially reduces aggregate real-world exposure compared to the raw score. The vulnerability is not in CISA KEV and no public exploit code has been identified; even a mid-sized municipal IT team in malbork that has deployed this product should treat remediation as urgent given that the exploitation path requires nothing more than network access and a crafted login request. EPSS data is absent from the available intelligence, so exploitation probability cannot be quantified from that signal. The primary risk driver is the VI:H metric - full management console control - rather than confidentiality or availability impact. |
| Exploit ScenarioDerived | An unauthenticated remote attacker locates a network-accessible Tegalog installation, then submits a crafted login value to the management console that satisfies the permissive regex without representing valid credentials. The attacker is granted full console access and proceeds to manipulate, exfiltrate, or delete memo log data. No public exploit code is known at time of analysis, but the low attack complexity (AC:L, AT:N) means independent rediscovery requires minimal skill. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 10, 2026
Authentication bypass in Tegalog (Fumy Otegaru Memo Logger) by Nishishi Factory permits remote unauthenticated attackers to access the management console by exploiting a permissive regular expression (CWE-625) used during login validation. Once inside the console, an attacker can perform any operation the management interface exposes - including creating, modifying, or deleting memo log entries. No public exploit code has been identified at time of analysis, and the product is absent from CISA's Known Exploited Vulnerabilities catalog.
Earlier versions of this analysis (1)
Authentication bypass in Tegalog (Fumy Otegaru Memo Logger) by Nishishi Factory allows remote unauthenticated attackers to log in to the management console by exploiting an overly permissive regular expression in the login validation logic. Once the authentication barrier is circumvented, an attacker gains the same operational access as a legitimate administrator, enabling full control over memo log content and management functions. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
RemediationAI
The primary remediation is to apply the vendor-released fix documented at https://www.nishishi.com/cgi/tegalog/info/notice20260629.shtml (published 2026-06-29), with the JVN advisory at https://jvn.jp/en/jp/JVN99975039/ providing supplementary disclosure details. A specific patched version number is not present in the available intelligence - consult the vendor notice directly to confirm the exact release to upgrade to. Until the patch is applied, operators should restrict network access to the Tegalog management console login endpoint: placing it behind IP allowlisting, a VPN gateway, or web-server-layer HTTP basic authentication are all viable compensating controls, though each introduces operational friction for legitimate administrators. Exposing the CGI endpoint directly to the Internet without any of these controls should be considered unacceptable given the unauthenticated exploitation path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tegalog is a CGI-based memo logging application developed by Nishishi Factory, identified by CPE cpe:2.3:a:nishishi_factory:tegalog_-fumy_otegaru_memo_logger-:*:*:*:*:*:*:*:*. The root cause is CWE-625 (Permissive Regular Expression), a class of weakness in which a pattern used for input validation or authentication matching is broad enough to be satisfied by inputs the developer did not intend to permit. In this instance, the regex governing management console login can be matched by crafted input without supplying legitimate credentials, effectively nullifying the authentication gate. JPCERT/CC reported and coordinated disclosure, with a JVN advisory (JVN#99975039) published alongside a vendor security notice dated 2026-06-29.
Know when Tegalog Fumy Otegaru Memo Logger gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Unauthenticated network login bypass sets PR:N and AV:N; integrity high from full console control; confidentiality and availability impacts are limited and scope is unchanged.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
3DescriptionCVE.org
Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from the management console.
Executive ViewAI
Tegalog (Fumy Otegaru Memo Logger) contains a critical authentication bypass in its management console, permitting remote unauthenticated attackers to gain full administrative access via a permissive regex flaw. This exposes your organization to data integrity compromise, unauthorized modification or deletion of memo logs, and potential audit trail tampering. The absence of a vendor patch creates persistent risk requiring immediate containment.
Restrict network access to the Tegalog management console via firewall rules or VPN-only access from authorized administrative networks; implement IP whitelisting at both network and application layers; enable and monitor comprehensive audit logs of all console access and administrative actions; establish real-time alerting for failed and successful authentication attempts; maintain offline backups to detect unauthorized data modifications; consider application-level reverse proxy with authentication overlay as temporary protective layer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB