CVE-2026-75415

Deferred Deferred - Pending Action

Incorrect Access Control in AntFlow V2.0.0

Publication date: 2026-08-26

Last updated on: 2026-09-03

Assigner: MITRE

Description

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive information leakage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-03

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-75415

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

AntFlow V2.0.0 has a vulnerability called Incorrect Access Control. The issue is in JiMuMDCCommonsRequestLoggingFilter.java where the userid is taken from the request header as part of identity verification. This allows attackers to forge user identity credentials, potentially leading to unauthorized access and sensitive data exposure.

Impact Analysis

This vulnerability could allow attackers to impersonate any user, gain unauthorized access to sensitive data, or perform actions on behalf of other users. It may lead to data breaches, unauthorized modifications, or service disruptions depending on the system's use.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to personal or health data. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately review and update the identity verification mechanism in JiMuMDCCommonsRequestLoggingFilter.java to prevent header-based user ID forgery. Ensure proper authentication and authorization checks are implemented.

Hi! I’m here to help you understand CVE-2026-75415. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70