CVE-2026-86934

Analyzed Analyzed - Analysis Complete

Authorization Bypass in FileMaker Server Web Publishing Engine

Publication date: 2026-09-23

Last updated on: 2026-10-05

Assigner: Apple Inc.

Description

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-10-05

Generated

2026-10-14

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-86934

EUVD

EUVD-2026-85431

Affected Vendors & Products

Vendor	Product	Version / Range
claris	filemaker_server	to 26.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an authorization bypass vulnerability in FileMaker Server's Web Publishing Engine. It allows requests with an extended privilege header to bypass a disabled setting called Custom Web Publishing with XML, granting access to the XML Web Publishing interface.

Detection Guidance

To detect this vulnerability, check if your FileMaker Server Web Publishing Engine is running a version prior to 26.0.3. Inspect HTTP requests for extended privilege headers that may bypass disabled XML Web Publishing settings. Monitor for unauthorized access attempts to the XML Web Publishing interface.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to the XML Web Publishing interface, potentially leading to data exposure or manipulation. Attackers might retrieve or alter sensitive information stored in FileMaker Server.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected FileMaker Server versions may face compliance violations and potential penalties.

Mitigation Strategies

Update FileMaker Server to version 26.0.3 or later to address the authorization bypass vulnerability in the Web Publishing Engine.

Hi! I’m here to help you understand CVE-2026-86934. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70