CVE-2026-89293— Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering
Quick assessment
Affected
Eclipse Foundation Eclipse Mnestix
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Eclipse Mnestix Browser 1.2.0 至 2.3.0（不含 2.3.0）版本中，未认证的攻击者可以执行仅限已授权 Mnestix 用户才能执行的操作，例如修改基础设施设置，或调用已连接且已认证的 Mnestix AAS 生成器后端服务。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89293
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Eclipse Foundation | Eclipse Mnestix | 1.2.0 ~ 2.3.0 | - |
|
II. Public POCs for CVE-2026-89293
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89293
请登录查看更多情报信息。
Other References for CVE-2026-89293 (2)
Same Patch Batch · Eclipse Foundation · 2026-11-03 · 5 CVEs total
| CVE-2026-89292 | 9.2 CRITICAL | Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser se |
| CVE-2026-115231 | 8.5 HIGH | User-mode module can post forged callback requests to another module's callback queue, run |
| CVE-2026-113421 | 7.3 HIGH | ThreadX Modules invokes trace-full callbacks after module unload |
| CVE-2026-92610 | Improper limitation of paths in py-aspect-model-loader |
IV. Related Vulnerabilities
Same vendor: Eclipse Foundation
-
CVE-2026-89292
Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure -
CVE-2026-92610
Improper limitation of paths in py-aspect-model-loader -
CVE-2026-113421
ThreadX Modules invokes trace-full callbacks after module un -
CVE-2026-115231
User-mode module can post forged callback requests to anothe -
CVE-2026-115215
NetX Secure DTLS server allocates a session for each new sou
Same weakness: CWE-862
-
CVE-2026-121458
Instatic before 0.0.21 Authorization Bypass via MCP Content -
CVE-2026-120330
Broken Access Control in extension "Mail" (mail) -
CVE-2026-4052
Privilege Escalation via Token Endpoint in WSO2 API Manager -
CVE-2025-1397
Improper IDP Status Validation via JWT Bearer or SAML2 Beare -
CVE-2026-120578
AI Alt Text Generator <= 2.7.0 - Missing Authorization to Un