{"id":"CVE-2026-102298","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-102298","generatedAt":"2026-10-28T06:35:02.728Z","title":"Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.","description":"In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. \n\nSuccessful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.","published":"2026-10-14T22:17:22.000Z","lastModified":"2026-10-16T15:17:02.000Z","status":"Deferred","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","cvss":{"version":"4.0","score":7.5,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-639","CWE-862"],"affected":[],"epss":{"score":0.00437,"percentile":0.37798,"date":"2026-10-27","history":[{"date":"2026-10-15","score":0.00437,"percentile":0.36465}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.44%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-14T22:17:22.000Z","detail":{"score":"7.5","severity":"HIGH","publishedAt":"2026-10-14T22:17:22.150Z"},"summary":"New CVE, high severity (CVSS 7.5)."}],"references":[{"url":"https://support.omadanetworks.com/en/download/software/omada-controller/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://support.omadanetworks.com/us/document/136187/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://support.omadanetworks.com/us/download/software/omada-controller/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102298","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}