CVE-2026-49192 Summary Service Insecure Direct Object Reference

Medium 5.3 Published 4 Jun 2026 Updated 4 Jun 2026

Attackers can access device data by manipulating hardware serial numbers in the summary service endpoint due to missing ownership verification.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-49192?

CVE-2026-49192 is a medium-severity missing authorization vulnerability in Acer Connect M6E 5G Portable WiFi Router, published on 4 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.

Weakness: CWE-639

Which versions are affected by CVE-2026-49192?

It affects 1 product.

Products include Acer Connect M6e 5g Firmware.

How do I fix CVE-2026-49192?

No fix has been published for CVE-2026-49192 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-49192 being exploited?

There is no known exploitation of CVE-2026-49192 in the wild and no public exploit code.

Sources

Also known as GHSA-873q-gr5f-jj67.