CVE-2026-106133

MEDIUM 6.3

Incorrect Authorization in Telerik Report Server Web Report Designer

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.

CWE	CWE-863
Vendor	progress software
Product	telerik report server
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for progress software telerik report server

Be the first to know when new medium vulnerabilities affecting progress software telerik report server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Affected Versions

Progress Software / Telerik Report Server

0 < 12.3.26.1110

References

NVD ↗ CVE.org ↗ EPSS Data ↗

telerik.com: https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-authorization-cve-2026-106133

Credits

Noam Frenkel