CVE-2026-26418

CVE-2026-26418 Web APIにおける認証・認可の欠如 脆弱性の概要 Tata Consultancy Services TCS – Cognix Recon Client v3.0 のWeb API層において、認証・認可の欠如に関する脆弱性が特定されました。 特定の公開APIエンドポイントが適切な認証・認可制御を実施しておらず、適切な検証なしにアプリケーション機能へのリモートアクセスが可能となっていました。 技術的分類 CWE CWE-306 – 重要な機能に対する認証の欠如 CWE-862 – 認可の欠如 影響を受けるエンドポイント...

CVE-2026-26417

CVE-2026-26417 パスワードリセット機能におけるアクセス制御の欠陥 脆弱性の概要 Tata Consultancy Services TCS – Cognix Recon Client v3.0 において、アクセス制御の欠陥が特定されました。 この問題により、認証済みユーザーが適切な認可検証なしに細工したAPIリクエストを送信することで、任意のユーザーアカウントのパスワードをリセットすることが可能となりました。 この脆弱性は、パスワードリセットワークフローにおける所有権検証の不備と認可チェックの欠如に起因します。 技術的分類 CWE CWE-862 – 認可の欠如 CWE-6...

CVE-2026-26416

CVE-2026-26416 認可バイパスの脆弱性による権限昇格 脆弱性の概要 Tata Consultancy Services TCS – Cognix Recon Client v3.0 において、権限昇格の脆弱性が特定されました。 この問題により、認証済みユーザーが細工したAPIリクエストを操作することで、定義されたロール境界を越えて権限を昇格させることが可能でした。 この脆弱性は、ロールベースのアクセス制御（RBAC）ロジックにおける検証の不十分さに起因し、予測可能なオブジェクト識別子が認可検証メカニズムをバイパスできる状態でした。 技術的分類（CWE） CWE-269 –...

CVE-2026-26418

Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network...

CVE-2026-26417

A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests...

CVE-2026-26416

An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaries via crafted requests...

EUVD-2026-9840

An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaries via crafted requests...

EUVD-2026-9841

A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests...

EUVD-2026-9842

Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network...

CVE-2026-26418

Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network...

CVE-2026-26417

A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests...

CVE-2026-26416

An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaries via crafted requests...

CVE-2026-26418

Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network...

CVE-2026-26417

A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests...

CVE-2026-26416

An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaries via crafted requests...

CVE-2026-26417

A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests...

CVE-2026-26416

An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaries via crafted requests...

CVE-2026-26417

The Tata Consultancy Services Cognix Recon Client v3.0 contains a broken access control vulnerability in its password reset functionality. Authenticated users can reset passwords for arbitrary user accounts by submitting crafted API requests to the endpoint http://clientreconhost/trapeze-client/p...

CVE-2026-26416

The Tata Consultancy Services Cognix Recon Client v3.0 is vulnerable to an authorization bypass that allows authenticated users to escalate privileges across role boundaries. The root cause is insufficient validation in the Role-Based Access Control (RBAC) logic, where predictable object identifi...

CVE-2026-26418

Tata Consultancy Services Cognix Recon Client v3.0 is vulnerable to a flaw where the Web API layer fails to enforce proper authentication and authorization controls. This missing validation (categorized under CWE-306 and CWE-862 ) allows remote attackers to access various application functions wi...