Missing Authorization in WS_FTP - CVE-2026-90863
Published: October 29, 2026
Vulnerability identifier: #VU158498
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90863
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to escalate privileges and perform actions beyond their intended administrative scope.
The vulnerability exists due to missing authorization and improperly controlled modification of dynamically determined object attributes in WS_FTP Manager when handling administrative changes. A remote privileged user can modify attributes without the required authorization checks to perform actions beyond their delegated privileges.
Affected software
WS_FTP
How to mitigate CVE-2026-90863
Install security update from vendor's website.
WS_FTP - addressed in versions 9.0.7, 10.0.4