CVE-2026-111793 Missing authorization in Webtop Media Transcoder
Authenticated users can bypass administrator-defined file type restrictions in Openwave Webtop Media Transcoder by bypassing the Webmail interface.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111793?
CVE-2026-111793 is a medium-severity missing authorization vulnerability in Openwave Messaging (Ireland) Limited Webtop Media Transcoder, published on 16 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Weakness: CWE-669
Which versions are affected by CVE-2026-111793?
How do I fix CVE-2026-111793?
No fix has been published for CVE-2026-111793 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111793 being exploited?
There is no known exploitation of CVE-2026-111793 in the wild and no public exploit code.
Sources
Also known as GHSA-5353-r4qc-2252.