CVE-2026-115803
Deferred Deferred - Pending Action

Authorization Bypass in Scada-LTS via AmCharts API

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: VulDB

Description
A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-115803
EUVD
EUVD-2026-109243

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a Scada-LTS 2.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass flaw in Scada-LTS 2.8.0. It exists in the AmChartValuesAPI.java component where the function HttpServletRequest.getParameter can be manipulated by altering the 'ids' argument. This allows remote attackers to bypass authorization checks.

Impact Analysis

The impact includes unauthorized access to sensitive data or system functions due to the authorization bypass. Attackers could exploit this remotely without authentication, potentially leading to data breaches or system manipulation.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized access to personal or health data. Organizations using Scada-LTS 2.8.0 may face legal penalties or data protection violations due to insufficient authorization controls.

Mitigation Strategies

Apply the vendor's upcoming security update once released. Temporarily restrict access to the AmCharts Data API endpoint until patched. Monitor network traffic for unusual requests targeting HttpServletRequest.getParameter in Scada-LTS 2.8.0.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115803. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart