CVE-2026-111793

Deferred Deferred - Pending Action

Openwave Webtop Media Transcoder File Type Bypass

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: MITRE

Description

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-111793

EUVD

EUVD-2026-103135

Affected Vendors & Products

Vendor	Product	Version / Range
Openwave	Messaging	(Ireland) Limited Webtop Media Transcoder 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-669	The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Attack-Flow Graph

Executive Summary

Openwave Webtop Media Transcoder fails to enforce administrator-defined file type restrictions during conversion. This allows authenticated users to bypass intended restrictions and process unintended document types outside the Webmail experience.

Impact Analysis

An attacker with valid credentials could convert unauthorized file types, potentially leading to unintended system behavior or resource consumption. However, it does not directly expose sensitive data or allow privilege escalation.

Compliance Impact

The vulnerability allows authenticated users to process unintended document types, which could lead to unauthorized data exposure or processing. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized access or processing of sensitive information.

Mitigation Strategies

Review and enforce file type restrictions in Openwave Webtop Media Transcoder to prevent unintended document conversions. Ensure administrator-defined rules are properly configured and cannot be bypassed.

Hi! I’m here to help you understand CVE-2026-111793. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70