CVE-2026-90450
Incorrect Authorization in Malcolm
CVSS Score
4.3
EPSS Score
0.4%
EPSS Percentile
26th
The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user regardless of their assigned role, and any newly added handler is fail-open by default until explicitly added to the table.
| CWE | CWE-863 |
| Vendor | cisa |
| Product | malcolm |
| Published | Sep 11, 2026 |
| Last Updated | Oct 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for cisa malcolm
Be the first to know when new medium vulnerabilities affecting cisa malcolm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
CISA / Malcolm
0 < v26.06.0