CVE-2026-86804 seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization
Remote attackers can bypass authorization checks in the HTTP handler to access protected resources in CPA Manager Plus.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86804?
CVE-2026-86804 is a medium-severity missing authorization vulnerability in seakee CPA-Manager-Plus, published on 8 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. Upgrading to version 1.11.11 is able to resolve this issue. The identifier of the patch is 842eec791377ddcbea5cd639bc065eaa4801d656. It is suggested to upgrade the affected component.
Which versions are affected by CVE-2026-86804?
How do I fix CVE-2026-86804?
No fix has been published for CVE-2026-86804 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-86804 being exploited?
There is no known exploitation of CVE-2026-86804 in the wild and no public exploit code.
Sources
Also known as GHSA-3wpw-f6pm-4qpv.