CVE-2026-86804 json
seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization
published 2026-09-08 2 mo ago modified 2026-09-11 58 d ago also EUVD-2026-74049
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. Upgrading to version 1.11.11 is able to resolve this issue. The identifier of the patch is 842eec791377ddcbea5cd639bc065eaa4801d656. It is suggested to upgrade the affected component.
Patch / fix
- seakee CPA-Manager-Plus 1.11.11
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 58 d ago
Exploit prediction
0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- seakee CPA-Manager-Plus
Classification
References
-
github.com
/seakee/CPA-Manager-Plus/pull/463
issue-tracking, patch
-
github.com
/seakee/CPA-Manager-Plus/commit/842eec791377ddcbea5cd639bc065eaa4801d656
patch
-
github.com
/seakee/CPA-Manager-Plus/releases/tag/v1.11.11
patch
-
vuldb.com
/vuln/399810
vdb-entry, technical-description
-
vuldb.com
/vuln/399810/cti
signature, permissions-required
-
vuldb.com
/cve/CVE-2026-86804
third-party-advisory
-
vuldb.com
/submit/911036
third-party-advisory
-
github.com
/seakee/CPA-Manager-Plus/issues/462
issue-tracking
-
github.com
/seakee/CPA-Manager-Plus/
product
Sources
- CVE List CVE-2026-86804
- NVD CVE-2026-86804
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.