CVE-2026-106133 · Package
NO FIX YET · SEE WHAT TO DO
Telerik Report Server prior to 12.3.26.1110 has an incorrect authorization flaw in the Web Report Designer. An authenticated user with low privileges can perform unauthorized operations on shared report resources, affecting their integrity and availability.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Telerik Report Server with the Web Report Designer reachable by users who hold a low-privilege account. Anonymous attackers are not described as able to exploit it. Instances on newer versions are not affected.
Not affected if no-low-privilege-accounts, patched-version
Who cares self-hosted, telerik-report-server, windows
12.3.26.111012.3.26.1110 are in scope; the sources do not list other checks12.3.26.1110 or laterIn Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.