CVE-2026-105046

Received Received - Intake

Unauthorized Access in Kentico Xperience 13

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: MITRE

Description

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-02

Generated

2026-10-03

AI Q&A

2026-10-03

EPSS Evaluated

N/A

NVD

CVE-2026-105046

EUVD

EUVD-2026-91832

Affected Vendors & Products

Vendor	Product	Version / Range
kentico	xperience	to 13.0.216 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-425	The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Attack-Flow Graph

Executive Summary

Kentico Xperience 13 before version 13.0.216 has a security flaw where administration API endpoints lack proper object-level authorization checks. This means unauthorized users might access or manipulate administrative functions and data they should not be able to.

Impact Analysis

An attacker with access to the system could exploit this to perform unauthorized actions such as viewing, modifying, or deleting sensitive data through the administration API. This could lead to data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance violations, fines, or legal consequences.

Mitigation Strategies

Update Kentico Xperience to version 13.0.216 or later to ensure object-level authorization checks are in place.

Hi! I’m here to help you understand CVE-2026-105046. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70