Erlang/OTP inets CVE-2026-74994

Three simultaneous conditions must hold for exploitation. First, the inets httpd server must have mod_auth configured with either a dets or mnesia authentication backend - plain-text and in-memory ETS backends are not affected by the namespace collapse. Second, the server configuration must define at least two distinct directory protection blocks targeting different paths, creating the multi-block scenario where the namespace is shared. Third, the attacker must already possess valid credentials for at least one of the protected directories on that server instance, reflecting the PR:L requirement in the CVSS vector. Exploitation is bounded to confidentiality: an attacker gains unauthorized read access to content in directories they should not reach but cannot modify data or disrupt service. Users with no credentials on the server at all cannot exploit this vulnerability.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L) yields a score of 6.0, accurately reflecting that network exploitation is mechanically simple but gated behind two prerequisites: a specific server configuration and possession of existing credentials. The AT:P (attack requirements present) flag is the key moderating signal - deployments with only one directory block or using plain-text/ETS backends are entirely unaffected. EPSS data is absent from the provided intelligence, limiting probabilistic exploitation forecasting. No CISA KEV listing and no public exploit code exist at time of analysis, keeping this out of the immediate triage tier despite the high confidentiality impact. Real-world risk scales directly with how much trust separation inets directory blocks are expected to enforce: even a mid-sized municipal IT team in sopot running inets-based internal administrative portals should treat patching as urgent if directory-level user segregation is a security control rather than mere convenience. The absence of integrity and availability impact (VI:N, VA:N) bounds the worst case to unauthorized read access, but for sensitive data partitioned by directory this remains a serious control failure.

An attacker who holds valid credentials for a low-sensitivity directory - for example, a read-only documentation area - submits an HTTP Basic Authentication request using those credentials against a higher-privilege directory such as an admin configuration endpoint on the same inets server instance. Because mod_auth queries the dets store without a directory-path qualifier, the user is found in the global namespace and authentication succeeds, returning a 200 response with the restricted content. No public exploit code exists at time of analysis, so exploitation requires manual construction of the HTTP request.