Eclipse Mnestix Browser <=2.3.0 Unauth Priv Escalation
CVE-2026-89293 Published on November 3, 2026
Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.
Vulnerability Analysis
CVE-2026-89293 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-89293 has been classified to as an AuthZ vulnerability or weakness.
Client-Side Enforcement of Server-Side Security
The software is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms resulting in potentially unexpected interactions between the client and server. The consequences will vary, depending on what the mechanisms are trying to protect.
Affected Versions
Eclipse Foundation Eclipse Mnestix:- Version 1.2.0 and below 2.3.0 is affected.