{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aeclipsemnestix_browser/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:eclipse:mnestix_browser:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-89293"},{"id":"CVE-2026-89292"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mnestix Browser (\u003c 2.3.0)"],"_cs_severities":["high"],"_cs_tags":["information-disclosure","cve","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Eclipse"],"content_html":"\u003cp\u003eCVE-2026-89293 is an authorization bypass vulnerability in the Eclipse Mnestix Browser. Versions 1.2.0 up to, but excluding, 2.3.0 allow unauthenticated attackers to perform actions restricted to authorized users. Specifically, an attacker can modify infrastructure settings or invoke operations on the connected and authenticated Mnestix AAS Generator backend. A public proof-of-concept exploit is available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn unauthenticated remote attacker can gain unauthorized control over sensitive infrastructure settings and interact with the connected Mnestix AAS Generator backend, potentially leading to unauthorized data manipulation or service disruption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade Eclipse Mnestix Browser to version 2.3.0 or later to remediate the authorization bypass.\u003c/li\u003e\n\u003cli\u003eAudit access logs for the Mnestix Browser and the associated AAS Generator backend for requests originating from unexpected or unauthorized network segments.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the Mnestix Browser and AAS Generator components using firewall or ingress rules to ensure they are not exposed to untrusted networks until patched.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T12:09:11Z","date_published":"2026-11-03T12:09:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-eclipse-mnestix-auth-bypass/","summary":"Eclipse Mnestix Browser versions 1.2.0 through 2.2.x are vulnerable to an authorization bypass allowing unauthenticated attackers to perform privileged actions, including infrastructure configuration changes and backend API calls.","title":"Eclipse Mnestix Browser: Unauthenticated authorization bypass (CVE-2026-89293)","url":"https://feed.craftedsignal.io/briefs/2026-11-eclipse-mnestix-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:eclipse:mnestix_browser:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}