Incorrect authorization in Gaia - CVE-2026-107484
Published: November 13, 2026
Vulnerability identifier: #VU166152
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-107484
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges, execute commands with elevated privileges, and gain full administrative control of the Gaia system.
The vulnerability exists due to improper input validation and authorization checks in Gaia Portal backend handlers when processing requests for privileged operations. A remote user can submit requests using a non-administrative account to perform operations that should be restricted to administrators.
Affected software
Gaia
How to mitigate CVE-2026-107484
Install security update from vendor's website.
Gaia - addressed in versions R81.20 Take 174, R82 Take 132, R82.10 Take 52, R82.20