Improper Authorization in Seakee CPA-Manager-Plus

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: VulDB

Description

A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. Upgrading to version 1.11.11 is able to resolve this issue. The identifier of the patch is 842eec791377ddcbea5cd639bc065eaa4801d656. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86804

Affected Vendors & Products

Vendor	Product	Version / Range
seakee	cpa-manager-plus	to 1.11.10 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authorization issue in seakee CPA-Manager-Plus up to version 1.11.10. It exists in the HTTP Handler component, specifically in the CPAResource function of the file apps/manager-server/internal/http/controller/proxy/handler.go. The flaw allows remote attackers to bypass authorization checks.

Impact Analysis

The vulnerability enables remote attackers to perform unauthorized actions by exploiting improper authorization. This could lead to unauthorized access to sensitive data or system functions. Upgrading to version 1.11.11 fixes the issue.

Mitigation Strategies

Upgrade seakee CPA-Manager-Plus to version 1.11.11 or later to resolve the improper authorization vulnerability.

Hi! I’m here to help you understand CVE-2026-86804. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70