CVE-2026-81531 Unauthenticated Account Information Disclosure in Multiple Omada Controllers
Unauthenticated attackers can query an exposed API endpoint to disclose account information, facilitating user enumeration and targeted attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81531?
CVE-2026-81531 is a medium-severity vulnerability in TP Link Systems Inc. OC200 V1, published on 8 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users.
Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.
Weakness: CWE-200
Which versions are affected by CVE-2026-81531?
How do I fix CVE-2026-81531?
No fix has been published for CVE-2026-81531 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81531 being exploited?
There is no known exploitation of CVE-2026-81531 in the wild and no public exploit code.
Sources
Also known as GHSA-2pv5-9q5x-x59w.