EUVD-2026-69383
GHSA-jg45-wrwh-x4rp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated API exploit with scope change indicated by subsequent-system impact in 4.0 vector; low impact across all three pillars.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.
AnalysisAI
Improper privilege management in Cleo Harmony's JWT Refresh Token Handler allows remote unauthenticated attackers to manipulate the Bearer argument on the /api/connections API endpoint, resulting in unauthorized access to connection data and potential privilege escalation. Affected versions span all releases up to and including 5.8.1.10, with a public exploit already available (E:P per CVSS 4.0 supplemental). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required - the CVSS 4.0 vector specifies AV:N/AC:L/AT:N/PR:N/UI:N, meaning remote unauthenticated exploitation against the /api/connections endpoint of any network-accessible Cleo Harmony instance running version 5.8.1.10 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely reachable, low-complexity, unauthenticated attack with no special deployment conditions, which is a high-priority posture for an internet-facing MFT appliance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Cleo Harmony to version 5.8.1.11, which the vendor has confirmed resolves this issue per the official release notes at https://support.cleo.com/hc/en-us/articles/30258468834583-Cleo-Harmony-5-8-1-Release-Notes#Version58111. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today