CVE-2026-89054

🗓️ 10 Sep 2026 19:36:21Reported by OpenNMSType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

Missing authorization in OpenNMS Horizon /api/v2 PATCH allows unauthenticated configuration changes.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-89054	10 Sep 202621:00	–	circl
Cvelist	CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes	10 Sep 202619:36	–	cvelist
EUVD	EUVD-2026-75707	10 Sep 202619:36	–	euvd
Mend	CVE-2026-89054	10 Sep 202619:36	–	mend
NVD	CVE-2026-89054	10 Sep 202620:17	–	nvd
osv_cve	CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes	10 Sep 202619:36	–	osv_cve
Positive Technologies	PT-2026-89576	10 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-89054: Missing Authorization	10 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes	10 Sep 202619:36	–	vulnrichment

[
  {
    "vendor": "The OpenNMS Group",
    "product": "Horizon",
    "repo": "https://github.com/OpenNMS",
    "versions": [
      {
        "status": "affected",
        "version": "36.0.0",
        "lessThan": "36.0.4",
        "versionType": "maven"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/OpenNMS/opennms/pull/8833

Parameter	Position	Path	Description	CWE
PATCH	path	/api/v2/event-configuration	Unauthenticated PATCH request to the event configuration endpoint allows an attacker to enable or disable event definitions.	CWE-862
PATCH	path	/api/v2/snmp-data-collection	Unauthenticated PATCH request to the SNMP data collection endpoint allows an attacker to enable or disable data-collection sources.	CWE-862

18 Sep 2026 19:21Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.2

EPSS0.0051

SSVC

CWE-862