CVE-2026-115803

Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization

View on CVE.org
Published Oct 24, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."

Analysis

AI-generated

Technical impact

A flaw in Scada‑LTS 2.8.0 allows an attacker to manipulate the "ids" parameter passed to the AmChartValuesAPI servlet. Because the servlet does not properly enforce authorization, this can result in an authorization bypass that lets the attacker read or modify data not intended for them. The vulnerability is delivered over HTTP and an exploit code has been published.

Affected Systems

The affected product is Scada‑LTS, specifically version 2.8.0. The vulnerability resides in the AmCharts Data API component, in the file AmChartValuesAPI.java, which is part of the broader Scada‑LTS platform.

Risk and Exploitability

The CVSS score of 5.3 reflects a moderate severity. EPSS is not available, but the existence of a published exploit means that exploitation is demonstrated in the wild. The vulnerability can be triggered remotely via normal HTTP requests, and the attack is not limited by technical restrictions. The vulnerability is not listed in the CISA KEV catalog, yet the remote nature and existence of exploit code warrant attention.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Scada‑LTS to the new release that contains the vendor’s security patches for the AmCharts Data API
  • If an upgrade is not immediately feasible, block or restrict access to the AmChartValuesAPI endpoints to trusted IP ranges only to reduce attack surface
  • Implement input validation or access‑control checks for the "ids" parameter in AmChartValuesAPI, ensuring that only authorized users can specify or modify the requested data

Generated by OpenCVE AI on October 24, 2026 at 08:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."
Title Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization
First Time appeared Scada-lts
Scada-lts scada-lts
Weaknesses CWE-285
CWE-639
CPEs cpe:2.3:a:scada-lts:scada-lts:*:*:*:*:*:*:*:*
Vendors & Products Scada-lts
Scada-lts scada-lts
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-639

    Authorization Bypass Through User-Controlled Key

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 26, 2026, 5:41 PM
Reserved
Oct 23, 2026, 3:14 PM

View source JSON

Updated
Oct 26, 2026, 3:39 PM

JSON

Status
Deferred
Published
Oct 24, 2026, 7:16 AM
Modified
Oct 26, 2026, 6:17 PM

View source JSON

No data.

Updated
Oct 24, 2026, 9:15 AM

JSON