CVE-2026-89293
Received Received - Intake

Unauthenticated Privilege Escalation in Eclipse Mnestix Browser

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Eclipse Foundation

Description
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-89293
EUVD
EUVD-2026-115729

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse Mnestix 1.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Eclipse Mnestix Browser affecting versions 1.2.0 to 2.2.0. It allows unauthenticated attackers to perform privileged actions like changing infrastructure settings or managing connections due to missing server-side authorization checks. The issue occurs because client-side UI protections are insufficient while server actions lack proper authentication and role validation.

Detection Guidance

To detect this vulnerability, inspect network traffic for unauthorized administrative actions or requests to /settings or /api/mnestixConnections endpoints. Check server logs for actions performed without authentication, especially changes to infrastructure settings or Mnestix AAS Generator backend interactions.

Impact Analysis

An attacker could exploit this to tamper with configurations, create or delete infrastructure records, or interact with backend systems like the Mnestix AAS Generator. This could lead to unauthorized changes, data loss, or potential credential injection. The impact depends on the application's use but may include compromised integrity and availability of critical systems.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data integrity, such as GDPR's security principles or HIPAA's access controls. Unauthorized changes to infrastructure or data could lead to non-compliance, potential fines, or legal consequences depending on the affected system's use case.

Mitigation Strategies

Immediately upgrade Eclipse Mnestix Browser to version 2.3.0 or later to address the authorization bypass. Ensure server-side authorization checks are enforced for all administrative actions and API endpoints. Review and restrict network access to the application to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89293. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...