CVE-2026-89293

{
  "etk_id": "ETK-2026-3360",
  "cve_id": "CVE-2026-89293",
  "display_id": "CVE-2026-89293",
  "ghsa_id": "GHSA-qfmx-cr8f-4rw3",
  "euvd_id": "EUVD-2026-115729",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing server-side authorization in Eclipse Mnestix Browser",
  "summary": "Eclipse Mnestix Browser versions 1.2.0 through 2.2.x do not properly enforce authorization on certain actions. An unauthenticated attacker can perform actions intended for authorized users, including changing Infrastructure settings or invoking the connected authenticated Mnestix AAS Generator backend, when they can reach the affected Browser instance.",
  "mitigation": "Upgrade Eclipse Mnestix to version 2.3.0 or later. Restrict network access to affected Browser instances until the upgrade is complete.",
  "vendor": "Eclipse Foundation",
  "product": "Eclipse Mnestix",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.2.0, < 2.3.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.3.0"
      ],
      "package_name": "Eclipse Mnestix",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 22.686937566666668,
  "t0_at": "2026-11-03T09:38:23.426000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-03T10:52:23.251461+00:00",
      "days": 0.05138686876157408,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T09:38:23.426000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-03T09:38:23.426000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T09:38:23.426000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89293"
    }
  }
}