EUVD-2026-91796

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...