CVE-2026-75415
Last modified
CVE-2026-75415 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive information leakage.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive information leakage.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | n/a |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-75415?
How severe is CVE-2026-75415?
How do I fix CVE-2026-75415?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-7538A vulnerability was identified in Totolink A8000RU 7.1cu.643…9.8
- CVE-2026-7539A potential security vulnerability has been identified in th…7.3
- CVE-2026-7541A denial of service vulnerability was identified in GitHub E…7.5
- CVE-2026-75411JeecgBoot v3.9.2 is vulnerable to Remote command execution. …9.8
- CVE-2026-75413DocSys V2.02.80 is vulnerable to Any File Download. An attac…7.5
- CVE-2026-75414In AntFlow V2.0.0, ActivitiTest.java enables users to execut…9.8
- CVE-2026-75417A SQL injection vulnerability was found in YzmCMS 7.5. The i…7.2
- CVE-2026-75418A path traversal vulnerability exists in the built-in previe…7.5
- CVE-2026-75419go-wind-cms (GoWind) before 1.0.0 has a missing authorizatio…8.8
- CVE-2026-7542The Slider Revolution plugin for WordPress is vulnerable to …6.5
- CVE-2026-75421aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in…4
- CVE-2026-75429PowerJob versions 4.x through 5.1.2 contain an unauthenticat…
Are you affected by CVE-2026-75415?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST