Read the docs
TI-2026-57837 Aliases CVE-2026-84115GHSA-jg45-wrwh-x4rp

Cleo Harmony JWT Refresh Token connections privileges management

Priority HIGH 70CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00472 41st percentileScored 2026-11-07
Fix Fixed Harmony (Cleo): 5.8.1.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CleoHarmony5.8.1.0; 5.8.1.1; 5.8.1.2; 5.8.1.3; 5.8.1.4; 5.8.1.5; 5.8.1.6; 5.8.1.7; 5.8.1.8; 5.8.1.9; 5.8.1.105.8.1.11Patch availableCNA
  • Harmony VendorCleo Affected 5.8.1.0; 5.8.1.1; 5.8.1.2; 5.8.1.3; 5.8.1.4; 5.8.1.5; 5.8.1.6; 5.8.1.7; 5.8.1.8; 5.8.1.9; 5.8.1.10 Fixed in 5.8.1.11 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:cleo:harmony:*:*:*:*:*:*:*:*——Cleo
  • cpe:2.3:a:cleo:harmony:*:*:*:*:*:*:*:* Versions — — ·Cleo

Remediation

  • Fix · CNA Harmony (Cleo) Fixed in 5.8.1.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84115
  2. 2026-10-03 Alias added: GHSA-jg45-wrwh-x4rp

References

Patch 1

  • TI-2024-36997 In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-34043 In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-20946 Exponential ReDoS in cleo leads to denial of service CVSS 3.1HIGH 7.5
  • TI-2021-12963 An issue was discovered in Cleo LexiCom 5.5.0.0. CVSS 3.1CRITICAL 9.8
  • TI-2021-12964 An issue was discovered in Cleo LexiCom 5.5.0.0. CVSS 3.1MEDIUM 5.3
  • TI-2026-57836 Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences