In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an...

0.71

github-advisories · v1 · published 11/3/2026, 12:31:48 PM · modified 11/3/2026, 12:31:54 PM · TLP:CLEAR

offsec.vulnerability

Source evidence ↗

Entities

cve: CVE-2026-89293cwe: CWE-602ghsa: GHSA-qfmx-cr8f-4rw3

Assessment

Fact summary

low · heuristic

In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.

Technical delta

low · heuristic

Automated delta unavailable (heuristic mode).

Defensive significance

low · heuristic

None identified (heuristic mode).

Extracted text

In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.