Description
A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.
Published: 2026-09-01
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

A flaw in the JWT Refresh Token Handler of Cleo Harmony enables manipulation of the Bearer argument in the /api/connections endpoint, causing the system to incorrectly manage user privileges. The resulting remote vulnerability allows an attacker to issue crafted requests that override or elevate authorization levels, potentially granting unauthorized access to sensitive functions or data. The CVSS score of 6.9 indicates moderate severity.

Affected Systems

Cleo Harmony versions up to 5.8.1.10 are affected. The vulnerability is resolved in version 5.8.1.11, which introduces proper privilege checks for the Bearer parameter in the /api/connections endpoint.

Risk and Exploitability

The exploit is remotely possible and a public proof‑of‑concept is available, increasing the likelihood of real‑world attacks even though the EPSS score is not published. The CVSS score of 6.9 reflects the moderate risk, and the vulnerability is not currently listed in CISA’s KEV catalog. Given the remote exploitation and the availability of a public exploit, organizations should treat this as a high‑priority issue and move quickly to remediate.

Generated by OpenCVE AI on September 1, 2026 at 16:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Cleo Harmony to version 5.8.1.11 to apply the vendor’s fix that enforces proper privilege validation on Bearer parameters.
  • Restrict exposure of the /api/connections endpoint by limiting network access to trusted hosts and by implementing additional authentication or rate‑limiting controls.
  • Continuously monitor API traffic for abnormal Bearer token modifications or repeated failed authentication attempts to detect potential abuse early.

Generated by OpenCVE AI on September 1, 2026 at 16:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.
Title Cleo Harmony JWT Refresh Token connections privileges management
First Time appeared Cleo
Cleo harmony
Weaknesses CWE-266
CWE-269
CPEs cpe:2.3:a:cleo:harmony:*:*:*:*:*:*:*:*
Vendors & Products Cleo
Cleo harmony
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 8.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}

Subscriptions

Cleo Harmony
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-01T15:58:24.289Z

Reserved: 2026-09-01T07:20:41.146Z

Link: CVE-2026-84115

cve-icon Vulnrichment

Updated: 2026-09-01T15:57:59.852Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T15:17:41.613

Modified: 2026-09-01T20:47:54.130

Link: CVE-2026-84115

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T16:30:17Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-269

    Improper Privilege Management