Read the docs
TI-2026-76412 Aliases CVE-2026-107186GHSA-fhwf-9fxr-chxq

Authentication bypass in Eptura Archibus DWR API lets workflow rules run

Priority MEDIUM 43CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Eptura Archibus versions from 0 before 2025.02 contain an improper authentication flaw in the Direct Web Remoting (DWR) API. An unauthenticated remote attacker can send a crafted DWR request that causes a workflow rule to run without authentication (CWE-287). The CVSS vector indicates a high confidentiality impact with scope change.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00362 30th percentileScored 2026-11-07
Fix Fixed Archibus (Eptura): 2025.02

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EpturaArchibusbefore 2025.022025.02Patch availableCNA
  • Archibus VendorEptura Affected before 2025.02 Fixed in 2025.02 Patch available CNA

Remediation

Upgrade Eptura Archibus to version 2025.02 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Archibus (Eptura) Fixed in 2025.02

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Eptura Archibus 2025.02

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-76414 File upload in Eptura Archibus lets attackers run code on the serverPriority MEDIUM 43
    • TI-2026-76413 Workflow rule in Eptura Archibus exposes sensitive database tablesPriority LOW 37
    Show all 3 records →

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-107186
  2. 2026-10-20 Alias added: GHSA-fhwf-9fxr-chxq
  3. 2026-10-20 CISA SSVC decision points changed

References

Other 1

  • TI-2026-76414 File upload in Eptura Archibus lets attackers run code on the server CVSS 3.1CRITICAL 9.6
  • TI-2025-19081 In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the… CVSS 3.1HIGH 7.5
  • TI-2026-76413 Workflow rule in Eptura Archibus exposes sensitive database tables CVSS 3.1HIGH 8.5
  • TI-2023-26493 An issue was discovered in the Archibus app 4.0.3 for iOS. CVSS 3.1HIGH 7.8
  • TI-2023-26492 An issue was discovered in the Archibus app 4.0.3 for iOS. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences