CVE-2026-90450
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user regardless of their assigned role, and any newly added handler is fail-open by default until explicitly added to the table.
| CWE | CWE-863 |
| Vendor | cisa |
| Product | malcolm |
| Published | Sep 11, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for cisa malcolm
Be the first to know when new unknown vulnerabilities affecting cisa malcolm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
CISA / Malcolm
0 < v26.06.0