CVE-2026-120224
Received Received - Intake

Improper Authorization in Oray Pugongying X5 Pro

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120224

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Oray Pugongying X5 Pro 7.6.0
Oray Pugongying X5 Pro 7.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authorization flaw in Oray Pugongying X5 Pro up to version 7.6.1. It exists in the API Authorization component, specifically in the functions run_apis_by_json and run_async_task. The issue allows remote attackers to bypass authorization checks, potentially gaining unauthorized access to sensitive functions or data.

Impact Analysis

This vulnerability can allow remote attackers to perform unauthorized actions on the affected system. Depending on the system's configuration, an attacker could access sensitive data, modify system settings, or disrupt services. The public availability of an exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. Organizations using the affected product may face legal penalties, data breach notifications, and reputational damage if exploited.

Mitigation Strategies

Immediately update Oray Pugongying X5 Pro to the latest version if available. If no update is available, restrict network access to the API Authorization component and disable remote access if possible. Monitor network traffic for unusual activity targeting the API endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120224. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...