Improper access control in Actstream - CVE-2026-107257
Published: October 9, 2026
Vulnerability identifier: #VU154023
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-107257
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the configuration route does not sufficiently check that the user editing it is the account owner. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.
Affected software
Actstream
How to mitigate CVE-2026-107257
Install updates from vendor's website.
Actstream - addressed in versions 2.0.1, 2.1.1