CVE-2026-81758

Deferred Deferred - Pending Action

Subscriber Broken Access Control in OwnerRez API

Publication date: 2026-08-31

Last updated on: 2026-09-01

Assigner: Patchstack

Description

Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-09-01

Generated

2026-09-21

AI Q&A

2026-09-01

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81758

Affected Vendors & Products

Vendor	Product	Version / Range
ownerrez	api	to 1.2.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a Subscriber Broken Access Control issue in the OwnerRez API versions up to and including 1.2.6. Broken access control means that users can access or modify data or functions they are not authorized to access, potentially leading to unauthorized actions or data exposure.

Detection Guidance

To detect this vulnerability, check the installed version of the OwnerRez API plugin. If it is 1.2.6 or below, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect plugin files for version details.

Impact Analysis

This vulnerability could allow attackers with low privileges to access or modify sensitive data, perform unauthorized actions, or escalate their privileges within the OwnerRez API system. This may lead to data breaches, loss of data integrity, or unauthorized system changes.

Compliance Impact

This vulnerability involves broken access control in the OwnerRez API, which could allow unauthorized users to access sensitive data. This may impact compliance with GDPR by potentially violating data access and protection requirements, and with HIPAA by risking unauthorized disclosure of protected health information.

Mitigation Strategies

Update OwnerRez API to the latest version beyond 1.2.6 to address the broken access control issue.

Hi! I’m here to help you understand CVE-2026-81758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70