{"id":"CVE-2026-105623","kind":"vulnerability","aliases":["CVE-2026-105623"],"related":[],"title":"Zenitel Connect: unauthenticated source maps expose front-end code and API logic","description":"The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.","summary":"Zenitel Connect versions before 1.11.0 serve production JavaScript source maps without requiring login. An remote attacker can download the full front-end source, including API usage and internal client logic.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["self-hosted","vendor","zenitel-connect"],"not_affected_if":["version-1.11.0-or-later"],"how_to_check":"- Check the installed Zenitel Connect version against `1.11.0`.\n- Request a known `.js.map` file from the web interface without logging in and see whether it is served.","fix":"- Upgrade Zenitel Connect to `1.11.0` or later.","status":"open","published_at":"2026-11-13T16:17:22+00:00","first_seen_at":"2026-11-13T16:47:32+00:00","triaged_at":"2026-11-13T16:48:48+00:00","updated_at":"2026-11-13T16:48:48+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-13T16:48:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Zenitel Connect to `1.11.0` or later.","reach":"internet","title":"Zenitel Connect: unauthenticated source maps expose front-end code and API logic","impact":"low","summary":"Zenitel Connect versions before 1.11.0 serve production JavaScript source maps without requiring login. An remote attacker can download the full front-end source, including API usage and internal client logic.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["zenitel-connect","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attackers read complete front-end source and internal API logic","analyst_note":"","how_to_check":"- Check the installed Zenitel Connect version against `1.11.0`.\n- Request a known `.js.map` file from the web interface without logging in and see whether it is served.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.11.0-or-later"],"who_is_affected":"Organisations running a Zenitel Connect web interface before 1.11.0 that is reachable by remote clients. Exposure is limited to disclosure of front-end source and API usage, not direct access to data. Installations already on 1.11.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4532,"output_tokens":478,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105623':16A,19A '-2026':15A,18A '1.11.0':31B,65C 'allow':74C 'api':12A,52B,87C 'attack':42B,76C 'authent':72C 'client':56B,91C 'code':10A,85C 'complet':80C 'connect':2A,26B,28B,63C 'cve':14A,17A 'download':44B 'end':9A,49B,83C 'expos':6A 'file':99C 'front':8A,48B,82C 'front-end':7A,47B,81C 'full':46B 'host':22B 'includ':51B,86C 'interfac':60C 'intern':55B,90C 'javascript':34B,68C 'logic':13A,57B,92C 'login':39B 'map':5A,36B,70C,98C 'obtain':78C 'product':33B,67C 'remot':41B,75C 'request':94C 'requir':38B 'self':21B 'self-host':20B 'serv':32B,66C 'sourc':4A,35B,50B,69C,84C,97C 'unauthent':3A 'usag':53B,88C 'vendor':23B 'version':29B 'via':93C 'web':59C 'without':37B,71C 'zenitel':1A,25B,27B,62C 'zenitel-connect':24B","nicknames":[],"mitigations":[],"who_affected":"Organisations running a Zenitel Connect web interface before 1.11.0 that is reachable by remote clients. Exposure is limited to disclosure of front-end source and API usage, not direct access to data. Installations already on 1.11.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","selfhosted","vendor","zenitelconnect"],"campaign_type":null,"search_a":"'-105623':16A,19A '-2026':15A,18A 'api':12A 'code':10A 'connect':2A 'cve':14A,17A 'end':9A 'expos':6A 'front':8A 'front-end':7A 'logic':13A 'map':5A 'sourc':4A 'unauthent':3A 'zenitel':1A","search_b":"'1.11.0':31B 'api':52B 'attack':42B 'client':56B 'connect':26B,28B 'download':44B 'end':49B 'front':48B 'front-end':47B 'full':46B 'host':22B 'includ':51B 'intern':55B 'javascript':34B 'logic':57B 'login':39B 'map':36B 'product':33B 'remot':41B 'requir':38B 'self':21B 'self-host':20B 'serv':32B 'sourc':35B,50B 'usag':53B 'vendor':23B 'version':29B 'without':37B 'zenitel':25B,27B 'zenitel-connect':24B","search_c":"'1.11.0':65C 'allow':74C 'api':87C 'attack':76C 'authent':72C 'client':91C 'code':85C 'complet':80C 'connect':63C 'end':83C 'file':99C 'front':82C 'front-end':81C 'includ':86C 'interfac':60C 'intern':90C 'javascript':68C 'logic':92C 'map':70C,98C 'obtain':78C 'product':67C 'remot':75C 'request':94C 'serv':66C 'sourc':69C,84C,97C 'usag':88C 'via':93C 'web':59C 'without':71C 'zenitel':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105623","severity":null,"published_at":"2026-11-13T16:17:22+00:00","modified_at":"2026-11-13T16:17:22+00:00","first_seen_at":"2026-11-13T16:47:32+00:00","fetched_at":"2026-11-13T16:47:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}