CVE-2026-90448

Received Received - Intake

Unauthorized Record Creation in Read-Only Deployment Mode

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ICS-CERT

Description

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application's own elevated backend credentials. This allows an authenticated user on a deployment intended to be read-only to forge or overwrite stored records that should not be modifiable in that deployment mode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-90448

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves a deployment mode meant to restrict access to read-only operations. However, it incorrectly allows certain API routes to accept request methods that should be blocked. One specific route, which should only allow read access, can be manipulated to create or overwrite stored records using the application's elevated backend credentials. This lets an authenticated user in a read-only deployment forge or modify records that should remain unchangeable.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized record creation or modification in read-only deployment modes. Inspect API logs for unexpected POST/PUT requests to routes that should only allow GET. Verify if any user accounts have elevated backend credentials without proper authorization. Check for records with attacker-chosen identifiers in storage systems.

Impact Analysis

If you use this system in a read-only deployment mode, an attacker with authenticated access could exploit this flaw to alter or delete critical data. This could lead to data corruption, unauthorized changes to records, or loss of data integrity. The impact depends on the sensitivity of the data and the system's role in your operations.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict data integrity and access controls, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized modifications to stored records may result in non-compliance, potential legal penalties, and loss of trust in data handling practices.

Mitigation Strategies

Disable or restrict write operations in read-only deployment modes. Review API routes to ensure only intended HTTP methods are allowed. Monitor logs for unauthorized record creation or modification attempts.

Hi! I’m here to help you understand CVE-2026-90448. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70