CVE-2026-107187

The Eptura Archibus platform is vulnerable to an unauthenticated database read via the AbCommonResources-getDataRecords workflow rule. An attacker can chain this with an authentication bypass in the isPasswordUppercase method to execute DWR requests without valid credentials. This allows unauthor...

EUVD-2026-104459

A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations ma...

CVE-2026-107187 Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables

A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations ma...