Read the docs
TI-2026-19396 Aliases CVE-2026-24069GHSA-446f-x529-8hw2

Improper Enforcement of Disabled Accounts in WebUI SSO in Kiuwan SAST

Priority LOW 24CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-863.

Summary

Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application. Kiuwan Cloud was affected, and Kiuwan SAST on-premise (KOP) was affected before 2.8.2509.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00189 8th percentileScored 2026-11-07
Fix Fixed SAST (Kiuwan): 2.8.2509.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KiuwanSASTbefore 2.8.2509.42.8.2509.4Patch availableCNA
  • SAST VendorKiuwan Affected before 2.8.2509.4 Fixed in 2.8.2509.4 Patch available CNA

Remediation

  • Fix · CNA SAST (Kiuwan) Fixed in 2.8.2509.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24069
  2. 2026-10-03 Alias added: GHSA-446f-x529-8hw2

References

Advisory 1

  • TI-2023-26775 XML External Entity Injection in Kiuwan SAST CVSS 3.1HIGH 7.2
  • TI-2023-26777 Insecure Direct Object Reference in Kiuwan SAST CVSS 3.1MEDIUM 6.5
  • TI-2023-26776 Reflected Cross-Site-Scripting in Kiuwan SAST CVSS 3.1MEDIUM 6.5
  • TI-2023-26778 Sensitive Data Stored Insecurely in Kiuwan SAST Local Analyzer CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences