CVE-2026-123218
waiting for further signalsZero needs more public information before it can validate it.description
IBM Aspera Faspex 5.0.0 through 5.0.19 is affected by an authorization bypass. An authenticated user may be able to obtain full administrative privileges by crafting a message that bypasses authorization checks.
mitigation
Restrict Faspex access to trusted, least-privileged accounts and closely monitor administrative-role changes. No fixed version is recorded in the advisory; obtain and apply IBM's vendor update or guidance when available.
outcome
Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-11-07 03:47Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-123218
{ "etk_id": "ETK-2026-3787", "cve_id": "CVE-2026-123218", "display_id": "CVE-2026-123218", "ghsa_id": null, "euvd_id": "EUVD-2026-118902", "status": "published", "anchor_state": "anchored", "title": "Authorization bypass in IBM Aspera Faspex", "summary": "IBM Aspera Faspex 5.0.0 through 5.0.19 is affected by an authorization bypass. An authenticated user may be able to obtain full administrative privileges by crafting a message that bypasses authorization checks.", "mitigation": "Restrict Faspex access to trusted, least-privileged accounts and closely monitor administrative-role changes. No fixed version is recorded in the advisory; obtain and apply IBM's vendor update or guidance when available.", "vendor": "IBM", "product": "Aspera Faspex", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 5.0.0, <= 5.0.19" ], "ecosystem": null, "fixed_versions": [], "package_name": "Aspera Faspex", "purl": null } ], "cwes": [ 863 ], "cvss_score": 9.8, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "contextual", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 44.85053933333333, "t0_at": "2026-11-07T03:47:19.566000+00:00", "signals": { "trigger_signal": { "at": "2026-11-07T03:47:19.566000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-11-07T03:47:19.566000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-123218" } } }
published 2026-11-07 04:04Z
last change 2026-11-08 00:40Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.