CVE-2026-90450

Received Received - Intake

Improper Authorization Default in Application

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ICS-CERT

Description

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user regardless of their assigned role, and any newly added handler is fail-open by default until explicitly added to the table.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-90450

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability involves an application that incorrectly grants access by default when a request handler's name is missing from its role requirements table. Instead of denying access, it allows any authenticated user to reach unregistered handlers regardless of their assigned role. New handlers are fail-open until explicitly added to the table.

Impact Analysis

An attacker could exploit this to access unauthorized functions or data by sending requests to unregistered handlers. This could lead to data breaches, privilege escalation, or unauthorized system modifications if the application relies on role-based access control.

Compliance Impact

This vulnerability likely violates compliance requirements for access control, such as GDPR's data protection principles or HIPAA's security rules, which mandate strict role-based access and default-deny policies. Non-compliance could result in legal penalties or data exposure risks.

Mitigation Strategies

Review all request handlers in the application to ensure they are explicitly registered in the role requirements table. Set default access to deny for any unregistered handlers. Audit authentication logs for unauthorized access attempts to unregistered handlers.

Hi! I’m here to help you understand CVE-2026-90450. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70