IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-01-01 17:15

MODIFIED

2026-01-01 17:15

EPSS (Prob. Exploit)

15.31%

Top 3.2%

⚡ EPSS ÉLEVÉ (15.3%)

DATA SOURCES:

NVD 🔗 2026-01-01 CVE PROJECT 🔗 2026-01-19 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-28

> DESCRIPTION

A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues. This issue affects Apache StreamPipes: through 0.97.0. Users are recommended to upgrade to version 0.98.0, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-269

> CWE DETAILED DESCRIPTIONS

CWE-269: Improper Privilege Management - The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

> GITHUB SECURITY ADVISORY

GHSA-5r2g-vphf-m5xc MODERATE

Apache StreamPipes has Improper Privilege Management issue

AFFECTED PACKAGES:

MAVEN / org.apache.streampipes:streampipes-parent

>= 0.69.0, < 0.98.0

Fixed in: 0.98.0

> HISTORIQUE DES MODIFICATIONS

Première apparition

01/01/2026 17:15

Source: NVD

📊 ENRICHISSEMENT 01/02/2026 06:44

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-269: Improper Privilege Management - The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

📊 ENRICHISSEMENT 19/01/2026 17:38

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui

Total des modifications: 2 Dernière mise à jour: 9 months ago