Eclipse Mnestix Browser: Unauthenticated authorization bypass (CVE-2026-89293)

CVE-2026-89293 is an authorization bypass vulnerability in the Eclipse Mnestix Browser. Versions 1.2.0 up to, but excluding, 2.3.0 allow unauthenticated attackers to perform actions restricted to authorized users. Specifically, an attacker can modify infrastructure settings or invoke operations on the connected and authenticated Mnestix AAS Generator backend. A public proof-of-concept exploit is available.

Impact

An unauthenticated remote attacker can gain unauthorized control over sensitive infrastructure settings and interact with the connected Mnestix AAS Generator backend, potentially leading to unauthorized data manipulation or service disruption.

Recommendation

• Immediately upgrade Eclipse Mnestix Browser to version 2.3.0 or later to remediate the authorization bypass.
• Audit access logs for the Mnestix Browser and the associated AAS Generator backend for requests originating from unexpected or unauthorized network segments.
• Restrict network access to the Mnestix Browser and AAS Generator components using firewall or ingress rules to ensure they are not exposed to untrusted networks until patched.