CVE-2026-100248

Deferred Deferred - Pending Action

Comparison to Unintended Admin Value in Rattadan Cosmowarp

Publication date: 2026-09-25

Last updated on: 2026-09-30

Assigner: MITRE

Description

The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-30

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-100248

EUVD

EUVD-2026-87152

Affected Vendors & Products

Vendor	Product	Version / Range
rattadan	cosmowarp_contract	to 56c6147 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1025	The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

Attack-Flow Graph

Executive Summary

The Rattadan Cosmowarp smart contract before commit 56c6147 has a flaw where a comparison operation may incorrectly use an unintended value for current_admin. This could allow unauthorized changes to contract administration if an attacker manipulates the comparison logic.

Detection Guidance

To detect this vulnerability, inspect the Cosmowarp_Contract's asset_registry smart contract for improper access control in the execute_update_asset function. Check if non-admin users can modify asset properties like name, image_url, description, or social media links without authorization. Review the ExecuteMsg::UpdateAsset message handling and validate if ticker updates lack proper case-sensitive checks.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain unauthorized administrative control over the smart contract. This might lead to fund theft, data manipulation, or disruption of contract functionality, depending on the contract's purpose.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's integrity and confidentiality requirements or HIPAA's security rules. Compliance failures could result in legal penalties or reputational damage.

Mitigation Strategies

Update the Rattadan Cosmowarp smart contract to version 56c6147 or later to address the admin comparison issue.

Hi! I’m here to help you understand CVE-2026-100248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70