Read the docs
TI-2026-83141 Aliases CVE-2026-119682GHSA-rfrw-7qrh-fh28

Improper access control in MFA of ManageEngine SharePoint Manager Plus

Priority MEDIUM 40CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

ManageEngine SharePoint Manager Plus (SPMP) from 450 before 4507 has an improper access control flaw in its multi-factor authentication (MFA) functionality, tracked under CWE-862 (Missing Authorization). A low-privileged authenticated user can bypass authorization checks to read and modify MFA settings, enable or disable MFA, list MFA-enrolled users and delete their accounts. An attacker could weaken authentication or cause a denial of service by setting invalid MFA configurations that lock legitimate users out of the application.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00344 28th percentileScored 2026-11-07
Fix Fixed SharePoint Manager Plus (ManageEngine): 4507

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ManageEngineSharePoint Manager Plus450 to before 45074507Patch availableCNA
  • SharePoint Manager Plus VendorManageEngine Affected 450 to before 4507 Fixed in 4507 Patch available CNA

Remediation

Upgrade ManageEngine SharePoint Manager Plus to build 4507 or later, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA SharePoint Manager Plus (ManageEngine) Fixed in 4507

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119682
  2. 2026-10-30 Alias added: GHSA-rfrw-7qrh-fh28
  3. 2026-11-01 Priority changed: MEDIUM → LOW
  4. 2026-11-06 CISA SSVC decision points changed
  5. 2026-11-06 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2015-06796 The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows… CVSS 3.0CRITICAL 9.8
  • TI-2014-04325 Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer… CVSS 3.0HIGH 8.8
  • TI-2017-08514 Path traversal in Zoho ManageEngine ServiceDesk CVSS 3.0HIGH 7.5
  • TI-2023-25530 Path traversal in ManageEngine OpManager CVSS 3.1CRITICAL 9.1
  • TI-2025-03383 SQL injection in ManageEngine ADSelfService Plus CVSS 3.1HIGH 8.1
  • TI-2025-24864 SQL injection in ManageEngine ADAudit Plus CVSS 3.1HIGH 8.3
See all 131 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences