CVE-2026-84115
Received Received - Intake

JWT Token Privilege Escalation in Cleo Harmony

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulDB

Description
A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84115
EUVD
EUVD-2026-69383

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cleo harmony to 5.8.1.10 (inc)
cleo harmony From 5.8.1.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Cleo Harmony up to version 5.8.1.10. It involves improper privilege management due to manipulation of the Bearer argument in the JWT Refresh Token Handler component. The issue allows remote attackers to exploit the system.

Impact Analysis

An attacker could remotely exploit this to gain unauthorized privileges or access sensitive data. The public exploit increases the risk of real-world attacks. Upgrading to version 5.8.1.11 fixes the issue.

Compliance Impact

The vulnerability allows improper privilege management due to manipulation of the Bearer token in JWT handling. This could lead to unauthorized access, potentially violating data protection requirements under GDPR and HIPAA by exposing sensitive data or allowing unauthorized modifications.

Mitigation Strategies

Upgrade Cleo Harmony to version 5.8.1.11 or later to fix the improper privilege management issue in the JWT Refresh Token Handler component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart