Configuration Modification via API in OpenText Access Manager

Publication date: 2026-06-24

Last updated on: 2026-06-29

Assigner: OpenText

Description

An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-29

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-11877

EUVD

EUVD-2026-38792

Affected Vendors & Products

Vendor	Product	Version / Range
microfocus	access_manager	From 5.0 (inc) to 5.1 (exc)
microfocus	access_manager	5.1
microfocus	access_manager	5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-648	The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthorized user to modify configuration settings through API calls in the OpenText Access Manager software. It affects versions before 5.1.3.

Impact Analysis

An unauthorized user modifying configuration settings could lead to improper system behavior, potential security weaknesses, or unauthorized access within the OpenText Access Manager environment.

Hi! I’m here to help you understand CVE-2026-11877. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70