Security Bulletin:Incorrect Authorization Vulnerability: Unauthenticated Access to CGI Scripts Protected by Directory Rules via script_alias in Erlang OTP (inets modules)

Summary Incorrect Authorization vulnerability in Erlang OTP inets modules allows unauthenticated access to CGI scripts protected by directory rules when served via scriptalias. When scriptalias maps a URL prefix to a directory outside DocumentRoot, modauth evaluates directory-based access control...

CVE-2026-28808

A flaw was found in Erlang OTP inets modules. A remote unauthenticated attacker could exploit an incorrect authorization vulnerability when CGI Common Gateway Interface scripts are served via scriptalias. This vulnerability arises from a path mismatch where access controls are evaluated against a...

AZL-83390 CVE-2026-28808 affecting package erlang for versions less than 26.2.5.19-1

Incorrect Authorization vulnerability in Erlang OTP inets modules allows unauthenticated access to CGI scripts protected by directory rules when served via scriptalias. When scriptalias maps a URL prefix to a directory outside DocumentRoot, modauth evaluates directory-based access controls agains...

CVE-2026-28808: Incorrect Authorization

Incorrect Authorization vulnerability in Erlang OTP inets modules allows unauthenticated access to CGI scripts protected by directory rules when served via scriptalias. When scriptalias maps a URL prefix to a directory outside DocumentRoot, modauth evaluates directory-based access controls agains...