CVE-2026-89293

UNKNOWN 0.0

Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.

CWE	CWE-862 CWE-602
Vendor	eclipse foundation
Product	eclipse mnestix
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse mnestix

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse mnestix are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse Mnestix

1.2.0 < 2.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gitlab.eclipse.org: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/772 gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/301

Credits

Eclipse Foundation Security Team