CVE-2026-89293
HighCVSS 8.8Summary
In Eclipse Mnestix Browser versions 1.2.0 up to but excluding 2.3.0, an unauthenticated attacker could perform actions only allowed to an authorized Mnestix user, such as changing Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.
Risk Assessment
Missing authorization checks allow unauthenticated parties to modify configuration and invoke backend services, potentially leading to unauthorized changes in the environment.
Recommendation
Update Eclipse Mnestix Browser to version 2.3.0 or later.
Other vulnerabilities in Eclipse Mnestix Browser
Original NVD description (English source)
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS