Description
ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint. 
This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
Published: 2026-10-30
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in ARKETEAM Protectel modules PROTECTELMAJ and BDF, allowing users with low privileges to invoke functionalities that are intended for administrators by forging direct requests to a particular endpoint. The attack grants unauthorized privileged actions, effectively bypassing the intended access controls. This represents a Privilege Escalation weakness identified as CWE-863.

Affected Systems

Affected are ARKETEAM Protectel modules PROTECTELMAJ and BDF. Versions v6.5.18 and older of PROTECTELMAJ, and v6.4.66 and older of BDF are vulnerable. The issue is fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via HTTP request forgery, requiring only knowledge of the specific endpoint and the ability to send crafted requests. Successful exploitation would elevate a user’s privileges, potentially allowing unauthorized configuration changes or data access.

Generated by OpenCVE AI on October 30, 2026 at 12:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch to PROTECTELMAJ v6.5.19 and BDF v6.4.67 immediately.
  • Review and restrict access to the vulnerable endpoint, ensuring that only users with administrative roles can invoke it.
  • Audit configuration and user permissions on all Protectel installations to confirm that role‑based access controls are correctly enforced and there are no legacy accounts with excessive privileges.

Generated by OpenCVE AI on October 30, 2026 at 12:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.  This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
Title Incorrect authorization in Protectel
First Time appeared Arketeam
Arketeam bdf
Arketeam protectelmaj
Weaknesses CWE-863
CPEs cpe:2.3:a:arketeam:bdf:*:*:*:*:*:*:*:*
cpe:2.3:a:arketeam:protectelmaj:*:*:*:*:*:*:*:*
Vendors & Products Arketeam
Arketeam bdf
Arketeam protectelmaj
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Arketeam Bdf Protectelmaj
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-10-30T15:27:21.077Z

Reserved: 2025-12-16T20:34:33.172Z

Link: CVE-2025-68392

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T12:16:33.303

Modified: 2026-10-30T12:16:33.303

Link: CVE-2025-68392

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T12:30:14Z

Weaknesses