Incorrect authorization in Erlang OTP - CVE-2026-74994
Published: September 2, 2026
Vulnerability details
The vulnerability allows a remote user to bypass directory-specific authorization controls.
The vulnerability exists due to incorrect authorization in the mod_auth module when processing authentication for multiple directory configuration blocks with dets or mnesia backends. A remote user can use valid credentials for one protected path to access other protected paths on the same httpd instance to bypass directory-specific authorization controls.
Only deployments configured with dets or mnesia authentication backends and two or more directory blocks with different require_user or require_group settings are vulnerable. Deployments using the plain authentication backend or a single directory block are not affected.