CVE-2026-11889

Received Received - Intake

Privilege Escalation in SALTO ProAccess Space via Tenancy Feature

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: ICS-CERT

Description

SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized attacker to access any space managed by the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-16

Last Modified

2026-07-16

Generated

2026-07-17

AI Q&A

2026-07-17

EPSS Evaluated

N/A

NVD

CVE-2026-11889

Affected Vendors & Products

Vendor	Product	Version / Range
salto	proaccess_space	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

The SALTO ProAccess Space software with the tenancy feature is vulnerable to privilege escalation. An authorized attacker could exploit this to gain access to any space managed by the affected product.

Impact Analysis

An attacker could access restricted spaces, potentially viewing or modifying sensitive data, leading to unauthorized actions or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and privacy such as GDPR and HIPAA.

Mitigation Strategies

Update SALTO ProAccess Space software to the latest version that addresses the privilege escalation vulnerability in the tenancy feature. Restrict access to administrative functions and monitor logs for unauthorized space access attempts.

Hi! I’m here to help you understand CVE-2026-11889. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70