{"id":"CVE-2026-106133","kind":"vulnerability","aliases":["CVE-2026-106133"],"related":[],"title":"Telerik Report Server: low-privilege users can change shared report resources","description":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.","summary":"Telerik Report Server prior to 12.3.26.1110 has an incorrect authorization flaw in the Web Report Designer. An authenticated user with low privileges can perform unauthorized operations on shared report resources, affecting their integrity and availability.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","telerik-report-server","windows"],"not_affected_if":["no-low-privilege-accounts","patched-version"],"how_to_check":"- Check the installed Telerik Report Server version against `12.3.26.1110`\n- Versions below `12.3.26.1110` are in scope; the sources do not list other checks","fix":"- Telerik Report Server: move to `12.3.26.1110` or later","status":"open","published_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","triaged_at":"2026-11-11T18:29:30+00:00","updated_at":"2026-11-11T18:29:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T18:29:30Z","model":"claude-haiku-5-5","output":{"fix":"- Telerik Report Server: move to `12.3.26.1110` or later","reach":"network","title":"Telerik Report Server: low-privilege users can change shared report resources","impact":"medium","summary":"Telerik Report Server prior to 12.3.26.1110 has an incorrect authorization flaw in the Web Report Designer. An authenticated user with low privileges can perform unauthorized operations on shared report resources, affecting their integrity and availability.","audience":"businesses","category":"package","nicknames":[],"who_cares":["telerik-report-server","self-hosted","windows"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"low-privilege user alters or disrupts shared report resources","analyst_note":"","how_to_check":"- Check the installed Telerik Report Server version against `12.3.26.1110`\n- Versions below `12.3.26.1110` are in scope; the sources do not list other checks","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","no-low-privilege-accounts"],"who_is_affected":"Teams running Telerik Report Server with the Web Report Designer reachable by users who hold a low-privilege account. Anonymous attackers are not described as able to exploit it. Instances on newer versions are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4553,"output_tokens":503,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106133':15A,18A '-2026':14A,17A '12.3.26.1110':33B,71C 'affect':58B,96C 'allow':81C 'attack':84C 'authent':45B,83C 'author':37B,74C 'avail':62B,100C 'chang':9A 'cve':13A,16A 'design':43B,80C 'flaw':38B 'host':22B 'incorrect':36B,73C 'integr':60B,98C 'low':5A,48B,86C 'low-privileg':4A 'oper':53B,91C 'packag':19B 'perform':51B,89C 'prior':31B,68C 'privileg':6A,49B,87C 'progress':64C 'report':2A,11A,25B,29B,42B,56B,66C,79C,94C 'resourc':12A,57B,95C 'self':21B 'self-host':20B 'server':3A,26B,30B,67C 'share':10A,55B,93C 'telerik':1A,24B,28B,65C 'telerik-report-serv':23B 'unauthor':52B,90C 'user':7A,46B 'version':70C 'vulner':75C 'web':41B,78C 'window':27B","nicknames":[],"mitigations":[],"who_affected":"Teams running Telerik Report Server with the Web Report Designer reachable by users who hold a low-privilege account. Anonymous attackers are not described as able to exploit it. Instances on newer versions are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","telerikreportserver","windows"],"campaign_type":null,"search_a":"'-106133':15A,18A '-2026':14A,17A 'chang':9A 'cve':13A,16A 'low':5A 'low-privileg':4A 'privileg':6A 'report':2A,11A 'resourc':12A 'server':3A 'share':10A 'telerik':1A 'user':7A","search_b":"'12.3.26.1110':33B 'affect':58B 'authent':45B 'author':37B 'avail':62B 'design':43B 'flaw':38B 'host':22B 'incorrect':36B 'integr':60B 'low':48B 'oper':53B 'packag':19B 'perform':51B 'prior':31B 'privileg':49B 'report':25B,29B,42B,56B 'resourc':57B 'self':21B 'self-host':20B 'server':26B,30B 'share':55B 'telerik':24B,28B 'telerik-report-serv':23B 'unauthor':52B 'user':46B 'web':41B 'window':27B","search_c":"'12.3.26.1110':71C 'affect':96C 'allow':81C 'attack':84C 'authent':83C 'author':74C 'avail':100C 'design':80C 'incorrect':73C 'integr':98C 'low':86C 'oper':91C 'perform':89C 'prior':68C 'privileg':87C 'progress':64C 'report':66C,79C,94C 'resourc':95C 'server':67C 'share':93C 'telerik':65C 'unauthor':90C 'version':70C 'vulner':75C 'web':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106133","severity":null,"published_at":"2026-11-11T18:18:24+00:00","modified_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","fetched_at":"2026-11-11T18:28:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}