CVE-2026-110669

Deferred Deferred - Pending Action

Authentication Bypass in cemtan sar2html 4.0.0

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulDB

Description

A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110669

EUVD

EUVD-2026-101623

Affected Vendors & Products

Vendor	Product	Version / Range
cemtan	sar2html	4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authentication issue in cemtan sar2html 4.0.0. Three endpoints (deleteHost, deleteRange, deleteAll) in sar2html.py allow unauthenticated remote attackers to permanently delete data without any authentication or authorization checks. The application lacks login requirements or session validation.

Detection Guidance

Check if sar2html 4.0.0 is installed and verify if the endpoints /<host_id>/deleteHost, /<host_id>/deleteRange, or /deleteAll are accessible without authentication. Use curl commands like 'curl -v http://<target>/deleteAll' to test for unauthenticated access.

Impact Analysis

An attacker could exploit this to remotely delete critical data by sending simple HTTP requests like a curl command to /deleteAll. This could lead to permanent data loss, system unavailability, and disruption of operations if no backups exist.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and integrity. GDPR mandates data integrity and availability, while HIPAA requires access controls for protected health information. Unauthorized deletion of data could result in non-compliance penalties and legal consequences.

Mitigation Strategies

Immediately upgrade sar2html to a patched version if available. If no patch exists, restrict network access to the application, disable the vulnerable endpoints, or consider removing the application until a fix is provided.

Hi! I’m here to help you understand CVE-2026-110669. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70