EUVD-2026-40956
GHSA-9cqm-4635-4v3j
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Unauthorized cross-user data access in Dassault Systèmes BIOVIA Workbook (Release 2021 through Release 2026) stems from a race condition that lets one authenticated low-privilege user read data belonging to another user. Vendor 3DS tags the flaw as an authentication bypass, and its CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L) reflects network-reachable exploitation by any authenticated account with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and no EPSS or KEV signal supplied.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Biovia Workbook gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (3DS) · only source for this CVE.
CVSS VectorVendor: 3DS
DescriptionCVE.org
A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user.
Executive ViewAI
Dassault Systèmes BIOVIA Workbook (Release 2021-2026) contains a race condition that allows any authenticated user to access confidential data belonging to other users, creating uncontrolled exposure of design and research intellectual property across the organization. This vulnerability threatens data confidentiality and integrity without requiring privilege escalation, affecting every active user regardless of role. Immediate access controls are required pending a vendor patch.
Within 24 hours: inventory all BIOVIA Workbook instances (confirm affected releases 2021-2026), enumerate active user accounts, and enable transaction-level audit logging. Within 7 days: restrict Workbook access to essential personnel only, enforce database-level role-based access controls to prevent cross-user reads, and disable any collaborative data-sharing features if operationally feasible. Within 30 days: monitor Dassault Systèmes security advisories for a patch release; evaluate vendor timeline and prepare upgrade or migration strategy to post-2026 releases.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) apply least-privilege database access to segment user datasets; (2) implement comprehensive audit logging of all data access with alerts for cross-user read attempts; (3) segregate Workbook infrastructure from other design systems if operationally feasible; (4) disable multi-user or concurrent session features; (5) require re-authentication between context switches or implement session timeouts to reduce race condition window.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Exploit-DB