CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041

UTMStack versions before 11.2.16 are vulnerable to a missing authorization flaw in the UTMIncidentCommandWebsocket.processCommand() function. Specifically, the handler mapped to the /command/{hostname} STOMP destination fails to perform role checks or apply a command allowlist. This allows any au...