Read the docs
TI-2026-71596 Aliases CVE-2026-89309GHSA-7chg-cp4g-f4v9

Missing authentication in JTL-WMS lets remote attackers use the API

Priority MEDIUM 49CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

JTL SW GmbH JTL-WMS versions before 2.0.7, before 2.1.2 and before 2.2.1 are affected, as are versions 1.7.*, 1.8.*, 1.9.*, 1.10.* and 1.11.*. The authorization middleware of the WMS MobileServer does not require authentication for HTTP methods other than GET and HEAD, and it accepts malformed or non-bearer Authorization headers, which is a missing authentication flaw (CWE-306). A remote attacker with network access to the service can invoke API functionality without valid credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00389 33rd percentileScored 2026-11-07
Fix Fixed JTL-WMS (JTL SW GmbH): 2.0.7, 2.1.2, 2.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JTL SW GmbHJTL-WMSbefore 2.0.7; before 2.1.2; before 2.2.1; all versions2.0.7, 2.1.2, 2.2.1Patch availableCNA
  • JTL-WMS VendorJTL SW GmbH Affected before 2.0.7; before 2.1.2; before 2.2.1; all versions Fixed in 2.0.7, 2.1.2, 2.2.1 Patch available CNA

Remediation

Fixed versions are 2.0.7, 2.1.2 and 2.2.1. The sources list no fixed version for JTL-WMS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA JTL-WMS (JTL SW GmbH) Fixed in 2.0.7, 2.1.2, 2.2.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    JTL-WMS — jtl-software.com/de/cve-2026-89309-cve-2026-89310

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-73773 SQL injection in JTL-WMS lets remote attackers run SQL statementsPriority MEDIUM 43
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-89309
  2. 2026-10-13 Alias added: GHSA-7chg-cp4g-f4v9
  3. 2026-10-14 Title updated · CNA
  4. 2026-10-14 CVSS score added · CNA
  5. 2026-10-14 Weakness changed · CNA
  6. 2026-10-14 Fix available: JTL SW GmbH/[email protected], JTL SW GmbH/[email protected], JTL SW GmbH/[email protected] · CNA
  7. 2026-10-14 1 new reference · CNA
  8. 2026-10-14 Priority changed: LOW → MEDIUM
  9. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-73773 SQL injection in JTL-WMS lets remote attackers run SQL statements CVSS 4.0CRITICAL 9.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences