Read the docs
TI-2026-30464 Aliases CVE-2026-42098GHSA-j7p7-w7pr-mwpc

Authorization Bypass in Sparx Enterprise Architect

Priority MEDIUM 40CWE-603Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior (e.g. using a debugger) and log in as any other user or administrator - then it is possible to do every possible change to the repository. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 17.1 and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00401 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Sparx SystemsEnterprise Architectup to 17.1—No fix listedCNA
  • Enterprise Architect VendorSparx Systems Affected up to 17.1 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42098
  2. 2026-10-03 Alias added: GHSA-j7p7-w7pr-mwpc

References

Advisory 2

Other 2

  • TI-2022-23300 SQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2026-30463 Authentication Bypass in Sparx Pro Cloud Server CVSS 4.0CRITICAL 9.3
  • TI-2025-14252 Plaintext Storage of a Password in Sparx Pro Cloud Server. CVSS 4.0CRITICAL 9.3
  • TI-2025-14251 Sparx Pro Cloud Server reveals sensitive information to an unauthenticated user CVSS 4.0CRITICAL 9.3
  • TI-2026-30462 Broken Access Control in Sparx Pro Cloud Server CVSS 4.0HIGH 8.7
  • TI-2025-14253 Unauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server CVSS 4.0CRITICAL 9.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences