CVE-2026-105623 · Vendor
NO FIX YET · SEE WHAT TO DO
Zenitel Connect versions before 1.11.0 serve production JavaScript source maps without requiring login. An remote attacker can download the full front-end source, including API usage and internal client logic.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organisations running a Zenitel Connect web interface before 1.11.0 that is reachable by remote clients. Exposure is limited to disclosure of front-end source and API usage, not direct access to data. Installations already on 1.11.0 or later are not affected.
Not affected if version-1.11.0-or-later
Who cares self-hosted, zenitel-connect
1.11.0..js.map file from the web interface without logging in and see whether it is served.1.11.0 or later.The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.