SB20261109105 - Incorrect authorization in Vert.x-Web

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109105

SB20261109105 - Incorrect authorization in Vert.x-Web

Published: November 9, 2026

Security Bulletin ID SB20261109105
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect authorization (CVE-ID: CVE-2026-102460)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to access resources without possessing the required authorization scopes.

The vulnerability exists due to skipped scope validation in Eclipse Vert.x Web's ChainAuthHandler when an earlier request handler has already authenticated the user and the chain contains scope-requiring authentication handlers. A low-privileged remote attacker can submit a valid token with insufficient scopes to routes using this configuration and bypass the chain's scope requirements.


Remediation

Install update from vendor's website.

References