EUVD-2026-98476
GHSA-8w49-pmq6-4mv2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
ExploitRequest admin-only roles endpoint
-
ExecutionMissing authorization check bypassed
-
ImpactView restricted role list
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged account on the Bender Customer & Partner platform (PR:L); exploitation is remote and needs no user interaction or special configuration. The limiting factor is the authentication prerequisite - an attacker must already possess valid low-tier credentials. Impact is bounded to disclosure of an administrator-only role list, explicitly described as non-sensitive, which further caps real-world severity. |
| Impact | This is a genuinely low-priority issue despite being network-exploitable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and base score of 5.3 (Medium) describe a remote, low-complexity flaw, but exploitation requires existing low-level privileges (PR:L), so it is not an unauthenticated internet-facing threat. Impact is confined to confidentiality (VC:L) with no integrity or availability effect (VI:N/VA:N) and no scope change (SC:N), and the description itself downplays sensitivity ('no particularly sensitive information is affected'). No EPSS score, CISA KEV listing, or SSVC decision data was provided, and no public exploit code is referenced - so there is no signal of active or probable exploitation. The one point of friction is the 'Authentication Bypass' tag, which conflicts with the actual weakness (CWE-862 Missing Authorization / broken access control under an authenticated session) - the vector's PR:L confirms authentication is required, so this is an authorization flaw, not an authentication bypass. Net: a real but minor information-disclosure weakness suitable for routine patching, not emergency response. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account on the Bender Customer & Partner portal issues a request to an administrative roles-listing function and receives role data that should be restricted to administrators. Because the flaw is network-accessible with low complexity and no user interaction, any authenticated low-tier user can repeat it trivially, but no public proof-of-concept has been identified and the disclosed data is characterized as non-sensitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Authenticated low-privileged users of the Bender Customer & Partner platform can retrieve the administrator-only role list because an affected endpoint performs no server-side authorization check (CWE-862). The flaw is reachable over the network with no user interaction, but an attacker must already hold a valid low-tier account, and the exposed data is explicitly limited to a non-sensitive role listing, so the impact is confined to a low-level confidentiality loss. No public exploit code has been identified at time of analysis, and the overall issue is a genuinely low-priority one: it is a broken access control on an already-authenticated endpoint rather than a true authentication bypass, despite the record's 'Authentication Bypass' tag.
RemediationAI
No vendor-released patch for CVE-2026-94410 was identified at time of analysis, so administrators should apply compensating controls while tracking CERT VDE advisory VDE-2026-109 (https://www.certvde.com/en/advisories/VDE-2026-109/) for the eventual fixed version and upgrade as soon as it is published. The most direct mitigation is to enforce server-side role authorization on the endpoint that returns the administrative role list; if the application cannot be modified, place a reverse proxy or WAF rule in front of that endpoint that rejects role-listing requests from sessions lacking an administrative role, accepting that this duplicates authorization logic outside the application and must be kept in sync with any endpoint path changes. Alternatively, restrict the affected administrative interface to trusted management networks or VPN-only access, at the cost of reduced usability for legitimate administrators. Because the disclosed data is an explicitly non-sensitive role list, the residual risk of a short delay in applying these controls is low, but the missing check should be treated as a symptom that may also exist on other administrative endpoints in the same product, so a broader authorization review is warranted. Log and monitor access to the role-listing endpoint to detect enumeration attempts by low-privileged accounts, and review role assignments for any accounts that should not exist.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862, Missing Authorization: the application exposes an administrative function that enumerates platform roles to any authenticated session without verifying that the caller holds an administrative role. The affected component is identified in the feed by CPE cpe:2.3:a:bender:customer&partner:*:*:*:*:*:*:*:*, whose wildcard version field means the advisory does not pin a specific release range, so the CERT VDE Product Security Response Team advisory (VDE-2026-109) is the authoritative source for the definitive affected-build list. The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N shows network attack vector, no attack requirements, low privileges required (PR:L), no user interaction, and no subsequent-system impact: only the vulnerable system's confidentiality is affected, and only at low severity. There is no integrity or availability impact, and nothing in the data suggests privilege escalation beyond the informational role listing. The independent assessment maps the same behavior to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (5.3), which is consistent with a bounded information-disclosure bug; the limiting control is the authentication prerequisite, since an attacker must already possess valid low-privileged credentials on the platform before the missing authorization check can be exercised.
Know when Customer Partner gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote low-complexity access by an authenticated low-privileged user (PR:L) yields limited confidentiality disclosure only (C:L), with no integrity or availability impact and no scope change.
Primary rating from Vendor (CERTVDE).
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
1DescriptionCVE.org
A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB