CVE-2026-113702
Deferred
Deferred - Pending Action
Authorization Bypass in Iomad PDF Certificate Handler
Vulnerability report for CVE-2026-113702, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-09
Last updated on: 2026-11-09
Assigner: VulDB
Description
Description
A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The patch is identified as ac7427130865ce0ed80870813317c87ae3060fa4/7bf0b10199782e04aa579e9d516e473b164afd1c/db903abdcb3aba124cce670608ae6d7ba5f51a84/66f7417c5357b7575e39e8be390602156c1a1225. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| n/a | iomad | 4.5.0 |
| n/a | iomad | 4.5.1 |
| n/a | iomad | 4.5.2 |
| n/a | iomad | 4.5.3 |
| n/a | iomad | 4.5.4 |
| n/a | iomad | 4.5.5 |
| n/a | iomad | 4.5.6 |
| n/a | iomad | 4.5.7 |
| n/a | iomad | 4.5.8 |
| n/a | iomad | 4.5.9 |
| n/a | iomad | 4.5.10 |
| n/a | iomad | 4.5.11 |
| n/a | iomad | 4.5.12 |
| n/a | iomad | 4.5.13 |
| n/a | iomad | 4.5.14 |
| n/a | iomad | 4.5.15 |
| n/a | iomad | 5.0.0 |
| n/a | iomad | 5.0.1 |
| n/a | iomad | 5.0.2 |
| n/a | iomad | 5.0.3 |
| n/a | iomad | 5.0.4 |
| n/a | iomad | 5.0.5 |
| n/a | iomad | 5.0.6 |
| n/a | iomad | 5.0.7 |
| n/a | iomad | 5.0.8 |
| n/a | iomad | 5.0.9 |
| n/a | iomad | 5.0.10 |
| n/a | iomad | 5.0.11 |
| n/a | iomad | 5.1.0 |
| n/a | iomad | 5.1.1 |
| n/a | iomad | 5.1.2 |
| n/a | iomad | 5.1.3 |
| n/a | iomad | 5.1.4 |
| n/a | iomad | 5.1.5 |
| n/a | iomad | 5.1.6 |
| n/a | iomad | 5.1.7 |
| n/a | iomad | 5.1.8 |
| n/a | iomad | 5.2.0 |
| n/a | iomad | 5.2.1 |
| n/a | iomad | 5.2.2 |
| n/a | iomad | 5.2.3 |
| n/a | iomad | 5.2.4 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
