> CVE-2026-40009

« BACK_TO_HOME
PUBLISHED
2026-07-10 08:16
MODIFIED
2026-07-10 08:16
EPSS (Prob. Exploit)
0.35%
Top 72.1%
DATA SOURCES:
NVD 🔗 2026-07-10 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25

> DESCRIPTION

Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor. This issue affects Apache IoTDB: from 2.0.8 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-269 CWE-284

> CWE DETAILED DESCRIPTIONS

CWE-269: Improper Privilege Management - The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. | CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

> HISTORIQUE DES MODIFICATIONS

Première apparition
10/07/2026 08:16
Source: NVD
📊 ENRICHISSEMENT 01/08/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-269: Improper Privilege Management - The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. | CWE-284: Impr...
Total des modifications: 1 Dernière mise à jour: 3 months ago

> REFERENCES

https://lists.apache.org/thread/65hh7dh28rcxlzdzwdpt630321tr8b61
« BACK_TO_HOME