CVE-2026-113422

{
  "etk_id": "ETK-2026-4061",
  "cve_id": "CVE-2026-113422",
  "display_id": "CVE-2026-113422",
  "ghsa_id": "GHSA-g9qx-c69p-gqxc",
  "euvd_id": "EUVD-2026-121148",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Eclipse Kura Wire updates",
  "summary": "Eclipse Kura 5.0.0 through 5.6.2 improperly authorizes Wire Graph configuration updates in the Web UI and Wire Service REST API. An authenticated user with Wires management privileges can change or replace non-Wire components, potentially gaining administrative control or affecting device operation; arbitrary component changes require an installed Driver.",
  "mitigation": "Upgrade Eclipse Kura to version 5.6.3 or later. Until upgrades are complete, restrict Wires management permissions to trusted administrators and limit access to the affected management interfaces.",
  "vendor": "Eclipse Foundation",
  "product": "Eclipse Kura",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, <= 5.6.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Eclipse Kura",
      "purl": null
    }
  ],
  "cwes": [
    807
  ],
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 22.5158268,
  "t0_at": "2026-11-10T14:36:40.001000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-10T14:36:40.001000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T14:36:40.001000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-113422"
    }
  }
}