CVE-2026-89054

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration and SNMP data collection (which enable and disable event definitions and data-collection sources) are reachable with no authorization enforced. An unauthenticated attacker able to reach the web UI can disable event definitions and SNMP data collection, suppressing event and alarm generation and stopping metric collection - silently degrading monitoring and detection - with the change persisted and reloaded into the running system. The solution is to upgrade to Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

• CWE-862

• https://github.com/OpenNMS/opennms/pull/8833

Published

Sep 10, 2026

Last Modified

Sep 18, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89044Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.1…6.5
• CVE-2026-89045zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate …4
• CVE-2026-89046zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of…8.2
• CVE-2026-89049A server-side request forgery issue due to improper validati…9.9
• CVE-2026-8905The Osiris Signature Banner plugin for WordPress is vulnerab…6.1
• CVE-2026-89050The Quads Ads Manager for Google AdSense WordPress plugin be…4.3
• CVE-2026-89055The Customer Reviews for WooCommerce plugin for WordPress is…9.1
• CVE-2026-89058A flaw was found in RESTEasy's CorsFilter, which, when confi…7.4
• CVE-2026-89059A flaw was found in RESTEasy's IIOImageProvider, which decod…7.5
• CVE-2026-8906The WP Promoter plugin for WordPress is vulnerable to Cross-…6.1
• CVE-2026-89060A cross-namespace authorization flaw in multicluster-observa…7.7
• CVE-2026-89063The Online Scheduling and Appointment Booking System – Bookl…7.5