Cpe:2.3:a:eclipse:mnestix_browser:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aeclipsemnestix_browser/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 12:09:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEclipse Mnestix Browser: Unauthenticated authorization bypass (CVE-2026-89293)https://feed.craftedsignal.io/briefs/2026-11-eclipse-mnestix-auth-bypass/Tue, 03 Nov 2026 12:09:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-eclipse-mnestix-auth-bypass/Eclipse Mnestix Browser versions 1.2.0 through 2.2.x are vulnerable to an authorization bypass allowing unauthenticated attackers to perform privileged actions, including infrastructure configuration changes and backend API calls.CVE-2026-89293 is an authorization bypass vulnerability in the Eclipse Mnestix Browser. Versions 1.2.0 up to, but excluding, 2.3.0 allow unauthenticated attackers to perform actions restricted to authorized users. Specifically, an attacker can modify infrastructure settings or invoke operations on the connected and authenticated Mnestix AAS Generator backend. A public proof-of-concept exploit is available.

Impact

An unauthenticated remote attacker can gain unauthorized control over sensitive infrastructure settings and interact with the connected Mnestix AAS Generator backend, potentially leading to unauthorized data manipulation or service disruption.

Recommendation

  • Immediately upgrade Eclipse Mnestix Browser to version 2.3.0 or later to remediate the authorization bypass.
  • Audit access logs for the Mnestix Browser and the associated AAS Generator backend for requests originating from unexpected or unauthorized network segments.
  • Restrict network access to the Mnestix Browser and AAS Generator components using firewall or ingress rules to ensure they are not exposed to untrusted networks until patched.
]]>highadvisoryinformation-disclosurecvevulnerability