eta-register EUVD-2026-115146

Exploitation requires the attacker to already have local access to the host and an authenticated low-privileged account on eta-register (AV:L, PR:L); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The flaw is a missing authorization check (CWE-862) that lets such a user escalate privileges in eta-register versions from 2.0.8 up to but not including 2.0.9. The exact feature, endpoint, or request that fails the authorization check is not described in the available sources. Limiting factors: the vulnerability is not remotely reachable and cannot be triggered by an unauthenticated or purely external attacker, so exposure is confined to systems where untrusted users can obtain a local, low-privilege session; updating to 2.0.9 is the stated resolution.

This is a locally-exploitable privilege-escalation flaw (CWE-862 Missing Authorization) with a vendor/CERT-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vector is internally consistent and credible: it is NOT remotely reachable (AV:L) and requires an attacker to already hold a low-privileged account (PR:L), but once that foothold exists the attack is low-complexity, needs no user interaction, and yields full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis - the input provides no EPSS score, no CISA KEV listing, and no PoC/exploit reference - so exploitation probability cannot be quantified from the data and nothing here indicates active exploitation. The vuln.today decision label is 'this_week', which positions this as a prompt-but-not-emergency remediation; that is consistent with a high technical impact tempered by the local-access and prior-privilege prerequisites. Net: a genuine escalation risk for environments where untrusted or semi-trusted users can authenticate to the product, but the local vector plus required low privileges substantially limit mass or opportunistic exploitation relative to a network-facing bug of the same CVSS. Note one labeling tension: the 'Authentication Bypass' tag conflicts with CWE-862 (Missing Authorization) and PR:L - this is a missing-authorization/privilege-escalation issue for an already-authenticated user, not a pre-auth bypass.

A user who already holds a low-privileged, authenticated account on a host running eta-register invokes a function or resource that lacks a proper authorization check, and thereby gains higher privileges than their role should permit. Because the CVSS vector is AV:L/AC:L/PR:L/UI:N, the action is performed locally, is low-complexity, and needs no interaction from another user. No public exploit code is identified in the available data; the specific vulnerable feature or request that bypasses the authorization check is not described in the advisory.