What is the CVSS score of EUVD-2026-57719?

EUVD-2026-57719 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-57719?

Yes, a patch is available for EUVD-2026-57719. Update the affected software to the latest version immediately.

OpenNMS Horizon EUVD-2026-57719

| CVE-2026-19182 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-13 OpenNMS

GHSA-r53w-fffc-9ppv

Authentication Bypass Horizon Meridian

4.3

CVSS 3.1 · Vendor: OpenNMS

Severity by source

Vendor (OpenNMS) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

REST API is network-accessible (AV:N), exploitation requires only a ROLE_REST account (PR:L) with no additional complexity, and impact is confined to alarm record integrity (I:L) with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (OpenNMS).

CVSS VectorVendor: OpenNMS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 13, 2026 - 05:30 vuln.today

Analysis Generated

Aug 13, 2026 - 05:30 vuln.today

DescriptionCVE.org

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_REST) to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLE_READONLY, to modify alarm state despite the read-only restriction. A credential check that should restrict these operations is guarded by an inverted condition, so it never executes for a real (non-blank) username. This can potentially allow an attacker to compromise the integrity of alarm state and audit records.

The solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

AnalysisAI

Incorrect authorization in OpenNMS Meridian and Horizon's v2 Alarm REST API allows any authenticated ROLE_REST user to acknowledge, escalate, or clear alarms attributed to arbitrary usernames, effectively forging audit records without holding delegation privileges. An inverted boolean condition in AlarmRestService.java - !StringUtils.isNotBlank(ackUser) instead of StringUtils.isNotBlank(ackUser) - renders the credential delegation check dead code for any non-blank username supplied in the request. Users simultaneously holding ROLE_REST and ROLE_READONLY can additionally bypass the read-only restriction to modify alarm state. No public exploit exists and the vulnerability is absent from CISA KEV; vendor-confirmed patches are available via OpenNMS GitHub PR #8755.

Technical ContextAI

OpenNMS Horizon and Meridian are Java-based network monitoring platforms sharing a common REST API layer. The vulnerable endpoint is the doUpdateProperties method in AlarmRestService.java, which handles HTTP PUT requests to the v2 alarms API for acknowledgement, escalation, and clear operations. The authorization guard was intended to prevent a user from submitting an ackUser parameter specifying a different username without holding delegation rights. Due to the logical negation error - the condition if (ackUser != null && !StringUtils.isNotBlank(ackUser)) evaluates to true only for blank strings, never for a real username - the enforcement block is entirely bypassed when an attacker supplies a non-blank arbitrary username. This is a textbook instance of CWE-863 (Incorrect Authorization): the check exists but is logically inverted, a logic flaw distinct from a missing control. CPE strings cpe:2.3:a:the_opennms_group:meridian:*:*:*:*:*:*:*:* and cpe:2.3:a:the_opennms_group:horizon:*:*:*:*:*:*:*:* confirm all versions of both products prior to the patched releases are affected.

RemediationAI

Upgrade OpenNMS Meridian to version 2024.3.12 or 2025.0.9 (whichever branch applies to the deployment), or upgrade OpenNMS Horizon to version 36.0.3 or newer, as confirmed by the vendor. The underlying fix - removing the logical negation from the StringUtils.isNotBlank() check in AlarmRestService.java - is a one-line change available in GitHub PR #8755 (https://github.com/OpenNMS/opennms/pull/8755); organizations capable of building from source can apply this immediately. As an interim workaround pending upgrade, audit and restrict ROLE_REST role assignments to only explicitly trusted service accounts, reducing the population of users able to exploit the flaw; be aware this does not eliminate risk for accounts that legitimately hold ROLE_REST. Additionally, enforce network-level access controls (firewall rules, VPN requirements) to ensure the OpenNMS REST API is not reachable from untrusted networks, consistent with the vendor's stated deployment guidance.