Description
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.
Published: 2026-10-19
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass allowing unauthenticated execution of workflow rules
Action: Immediate Patch
AI Analysis

Impact

The vulnerability occurs when an unauthenticated user crafts a Direct Web Remoting request that first calls the isPasswordUppercase method, followed by a second call that triggers a workflow rule execution. Because the application does not verify the authentication state for the second call, workflow rules can run without user credentials. This bypass allows an attacker to run arbitrary business logic, potentially altering data or initiating actions without authorization.

Affected Systems

Eptura Archibus is impacted. The flaw exists in all deployed versions of the Archibus platform that expose the DWR API, as specific version information is not disclosed. Organizations using Eptura:Archibus should verify whether the DWR interface is exposed to untrusted networks.

Risk and Exploitability

The CVSS score of 8.6 classifies this flaw as High severity. EPSS data is unavailable, yet the vulnerability has been publicly demonstrated and is not listed in CISA’s KEV catalog. Attackers can exploit it from any network location able to reach the DWR API endpoint; no special privileges are required beyond network connectivity.

Generated by OpenCVE AI on October 19, 2026 at 17:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the vendor‑provided security patch that removes the DWR authentication bypass in Eptura Archibus.
  • If the patch cannot be applied immediately, limit exposure of the DWR endpoint by allowing access only from trusted IP ranges via firewall or reverse‑proxy rules, and block unauthenticated requests.
  • As a temporary measure, disable or restrict workflow execution routes that can be triggered through DWR until the patch is applied, or enforce authentication checks at the workflow entry points.

Generated by OpenCVE AI on October 19, 2026 at 17:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Eptura
Eptura archibus
Vendors & Products Eptura
Eptura archibus

Mon, 19 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.
Title Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Eptura Archibus
cve-icon MITRE

Status: PUBLISHED

Assigner: rapid7

Published:

Updated: 2026-10-20T19:30:17.854Z

Reserved: 2026-10-07T13:22:58.186Z

Link: CVE-2026-107186

cve-icon Vulnrichment

Updated: 2026-10-20T19:30:14.387Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T17:17:00.827

Modified: 2026-10-20T20:17:13.233

Link: CVE-2026-107186

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T18:30:02Z

Weaknesses