EUVD-2026-103135
GHSA-5353-r4qc-2252
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to webmail account
-
DeliveryBypass Webmail UI to reach transcoder directly
-
ExploitSubmit restricted/unintended file types for conversion
-
ExecutionForce unintended processing
-
ImpactDegrade transcoding availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect resource transfer between spheres
|
| Exploitation Conditions | Requires a valid authenticated webmail account on Openwave Webtop Media Transcoder (CVSS PR:L), and the attacker must interact with the transcoder outside the normal Webmail experience - i.e. invoking the conversion function directly to sidestep the UI-layer enforcement of administrator-defined allowed file types. Exploitation is limited by the need for prior authentication and by the fact that administrator file-type restrictions only matter where they have been configured; impact is confined to availability (document processing of unintended types), with no confidentiality or integrity effect. |
| Impact | This is a low-severity, authenticated-only issue that does not warrant priority remediation. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base 4.3) shows the only impact is a Low hit to availability, with no confidentiality or integrity consequence, and it requires an authenticated user (PR:L). No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so by the precision rules this is 'no public exploit identified at time of analysis.' CWE-669 (incorrect resource transfer between spheres) matches the description: the transcoder fails to enforce administrator-defined file-type restrictions when the normal Webmail path is bypassed. There is no conflict between the CVSS vector and the description - both point to an authenticated user abusing an unrestricted conversion feature for marginal impact. Note that the input tag 'Authentication Bypass' appears inconsistent with the facts: PR:L and the description describe a restriction/control bypass by an already-authenticated user, not a bypass of authentication itself - verify tag accuracy with the vendor advisory. |
| Exploit ScenarioDerived | An authenticated webmail user crafts requests directly against the media transcoder endpoint, bypassing the Webmail UI that normally enforces allowed file types, and submits document types the administrator intended to block. By repeatedly forcing conversion of unintended or large/complex documents the user can consume transcoding resources, degrading service availability. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Openwave Webtop Media Transcoder fails to enforce the administrator-defined file-type restrictions that are meant to limit which documents may be converted, so an authenticated webmail user can reach the transcoding function outside the normal Webmail UI and have unintended document types processed. The flaw carries a CVSS v3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), meaning any exploitation is confined to a low availability impact - no loss of confidentiality or integrity - and it requires a valid authenticated webmail account (PR:L). No public exploit code has been identified at time of analysis, KEV status is not indicated, and no EPSS score was supplied; this is a low-severity, authenticated-only issue that does not warrant priority remediation.
RemediationAI
No vendor-released patch version was identified in the available data; confirm current guidance and any fixed build directly with Openwave via https://openwave.ai and the advisory at https://github.com/GISOpenwave/security-advisories-public/blob/main/CAN-2026-2032674.md before assuming a remediated release exists. Until a fix is confirmed, the most effective compensating control is to remove the transcoder's reachability from anything other than the Webtop Webmail application itself - bind the conversion service to a loopback or management interface, firewall it so only the Webmail front-end hosts can connect, and require authentication at that boundary; the trade-off is that direct or integrated third-party callers of the transcoder will break and any legitimate out-of-band conversion workflows must be re-routed through Webmail. Organisations that do not need server-side conversion can disable the transcoder entirely, accepting the loss of that feature, or restrict the service account and worker pool to a small CPU/memory quota so that abuse cannot degrade overall platform availability. Additionally, log and alert on conversion requests whose file type falls outside the administrator's configured allow list and on requests arriving from anything other than the Webmail front-end, which detects bypass attempts without altering application behaviour. Because this is an authenticated-only issue with availability-limited impact and no known public exploit, none of these measures should displace higher-priority remediation work.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Openwave Webtop Media Transcoder, a server-side document/media conversion service that sits behind the Webtop webmail experience and is normally invoked through that interface. Openwave's design relies on the Webmail layer to restrict which file types a user may submit for conversion according to administrator-configured policy; the transcoder itself does not independently re-validate or enforce that allow/deny list. The CVE is classified as CWE-669 (Incorrect Resource Transfer Between Spheres), which describes a boundary or trust-domain weakness: enforcement of a security policy is applied in one sphere (the Webmail UI/application layer) but the protected resource (the transcoder) can be reached from another sphere, so the control is bypassed when the conversion endpoint is called directly rather than through Webmail. The CPE entry cpe:2.3:a:openwave_messaging_(ireland)_limited:webtop_media_transcoder:*:*:*:*:*:*:*:* uses a wildcard version, so the advisory does not enumerate a specific affected release range from the data provided; the impact is limited to availability because unintended document processing consumes transcoder resources, with no read or write of protected data.
Know when Webtop Media Transcoder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Authenticated webmail user (PR:L) reaches the transcoder over the network (AV:N/AC:L) with no UI; only availability is affected (A:L), with no confidentiality or integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
1DescriptionCVE.org
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB