Incorrect Auth in Progress MOVEit Transfer Audit User Module before 2025.1.3
CVE-2026-8800 Published on July 8, 2026
Cross-Org External Token Metadata accessible to AuditUser role
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
Vulnerability Analysis
CVE-2026-8800 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-8800 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-8800
Want to know whenever a new CVE is published for Progress Moveit Transfer? stack.watch will email you.
Affected Versions
Progress MOVEit Transfer:- Version 2025.1.0 and below 2025.1.3 is affected.
- Before 2025.0.7 is affected.