CVE-2026-119682

An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506.

• CWE-862

• https://pitstop.manageengine.com/portal/en/community/topic/sharepoint-manager-plus-build-4507-released

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119663Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a brok…4.3
• CVE-2026-119664Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an aut…4.3
• CVE-2026-119665WHartTest 2.2.0 through 2.8.1 contains a missing authorizati…6.3
• CVE-2026-11967MobaXterm Personal Edition (Portable), in its 26.3 version (…8.5
• CVE-2026-11968Argument Injection in TortoiseGitBlame via Malicious Git His…5.5
• CVE-2026-119680A stored cross-site scripting (XSS) vulnerability exists in …8.5
• CVE-2026-11969The WP TripAdvisor Review Slider plugin for WordPress is vul…4.9
• CVE-2026-119699WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled …5.3
• CVE-2026-1197A vulnerability was detected in MineAdmin 1.x/2.x. Affected …3.1
• CVE-2026-11970This vulnerability allows a normal (non-admin) user to disab…4.8
• CVE-2026-119700WPGraphQL before 2.24.2 contains an information disclosure v…5.3
• CVE-2026-119701WPGraphQL before 2.24.1 contains a missing rate limiting vul…5.3