EUVD-2026-76747
GHSA-q9h9-qwh3-9392
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity path-based SSRF gated on authenticated low-privilege user; scope unchanged; impact limited to partial confidentiality disclosure with no integrity or availability consequences.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
1DescriptionCVE.org
An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend path, causing the application's own elevated service credentials to be used against unintended internal endpoints. This could allow an attacker to enumerate or read internal configuration and administrative data from the backend data store that would otherwise be restricted.
AnalysisAI
Path-based server-side request forgery in an ICS inventory management platform allows authenticated low-privilege users to inject arbitrary path components into backend requests destined for an internal search and analytics data store. The application unwittingly proxies attacker-controlled paths using its own elevated service credentials, enabling enumeration and reading of internal configuration and administrative data from the backend that would otherwise be inaccessible. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid user account with at least low-privilege access to the ICS inventory management application, as confirmed by PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.3 (Medium) is broadly consistent with the technical reality: the PR:L metric confirms a valid account is required, the VC:L metric caps the confidentiality impact at partial disclosure, and the complete absence of integrity or availability metrics (VI:N/VA:N/SC:N/SI:N/SA:N) correctly reflects the read-only nature of the flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the vendor advisory ICSA-26-254-01 via the CSAF file at the cisagov GitHub repository for official patch version details, which are not independently confirmed in the available CVE data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today