CVE-2026-107795

Deferred Deferred - Pending Action

Unauthorized Certificate Management in Omada Controller

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: TPLink

Description

Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107795

EUVD

EUVD-2026-101711

Affected Vendors & Products

Vendor	Product	Version / Range
TP-Link	Systems	Inc. Omada Software Controller 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Omada Controller's MSP and OpenAPI certificate/private-key management APIs lack proper administrative authorization checks. This allows an authenticated user, even with low privileges, to perform privileged operations like uploading or deleting the controller's TLS certificate or private key.

Detection Guidance

Detecting this vulnerability requires checking Omada Controller's API endpoints for improper authorization in certificate management. Inspect network traffic for unauthorized POST/PUT/DELETE requests to /api/v2/msp/certificates or /api/v2/openapi/certificates. Verify user roles and audit logs for low-privileged accounts performing certificate operations.

Impact Analysis

A low-privileged authenticated user could disrupt secure management access by replacing or deleting the controller's TLS certificate or private key, potentially causing service outages or unauthorized access.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by allowing unauthorized users to manipulate TLS certificates and private keys. Unauthorized certificate changes could disrupt secure management access, potentially exposing sensitive data or violating encryption requirements mandated by these regulations.

Mitigation Strategies

Restrict administrative access to Omada Controller's MSP and OpenAPI certificate/private-key management APIs. Ensure only high-privileged users can perform certificate management operations. Monitor logs for unauthorized certificate uploads or deletions.

Hi! I’m here to help you understand CVE-2026-107795. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70