Read the docs
TI-2026-76413 Aliases CVE-2026-107187GHSA-xxc6-v8c2-mg2f

Workflow rule in Eptura Archibus exposes sensitive database tables

Priority LOW 37CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Eptura Archibus versions from 0 before 2025.02 expose database details to a user. A user can read sensitive database tables, such as usernames and passwords, by sending a crafted DWR request that specifies a workflow rule, which is an information exposure flaw (CWE-200). A remote attacker with low privileges can read the data without user interaction, and the source notes that database write and delete operations may also be possible but were not tested. The flaw can be chained with an authentication bypass to perform these reads without authentication.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00275 19th percentileScored 2026-11-07
Fix Fixed Archibus (Eptura): 2025.02

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EpturaArchibusbefore 2025.022025.02Patch availableCNA
  • Archibus VendorEptura Affected before 2025.02 Fixed in 2025.02 Patch available CNA

Remediation

Upgrade Eptura Archibus to version 2025.02.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Archibus (Eptura) Fixed in 2025.02

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Eptura Archibus 2025.02

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-76414 File upload in Eptura Archibus lets attackers run code on the serverPriority MEDIUM 43
    • TI-2026-76412 Authentication bypass in Eptura Archibus DWR API lets workflow rules runPriority MEDIUM 43
    Show all 3 records →

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-107187
  2. 2026-10-20 Alias added: GHSA-xxc6-v8c2-mg2f
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-76414 File upload in Eptura Archibus lets attackers run code on the server CVSS 3.1CRITICAL 9.6
  • TI-2026-76412 Authentication bypass in Eptura Archibus DWR API lets workflow rules run CVSS 3.1HIGH 8.6
  • TI-2025-19081 In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the… CVSS 3.1HIGH 7.5
  • TI-2023-26493 An issue was discovered in the Archibus app 4.0.3 for iOS. CVSS 3.1HIGH 7.8
  • TI-2023-26492 An issue was discovered in the Archibus app 4.0.3 for iOS. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences