CVE-2026-42796

Arelle versions prior to 2.39.10 are vulnerable to an unauthenticated remote code execution (RCE) vulnerability within the /rest/configure REST endpoint. The flaw exists because the plugins query parameter is forwarded to the plugin manager without proper authentication or authorization. An attac...