---
id: "CVE-2026-106133"
page: "https://infrastack.ai/live/CVE-2026-106133"
kind: "vulnerability"
aliases: ["CVE-2026-106133"]
title: "Telerik Report Server: low-privilege users can change shared report resources"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "telerik-report-server", "windows"]
not_affected_if: ["no-low-privilege-accounts", "patched-version"]
published_at: "2026-11-11T18:18:24+00:00"
first_seen_at: "2026-11-11T18:28:42+00:00"
updated_at: "2026-11-11T18:29:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106133", "first_seen_at": "2026-11-11T18:28:42+00:00"}]
exploit_sources: []
---

# Telerik Report Server: low-privilege users can change shared report resources

Link for people: https://infrastack.ai/live/CVE-2026-106133 (this .md is for agents)

Telerik Report Server prior to 12.3.26.1110 has an incorrect authorization flaw in the Web Report Designer. An authenticated user with low privileges can perform unauthorized operations on shared report resources, affecting their integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Telerik Report Server version against `12.3.26.1110`
- Versions below `12.3.26.1110` are in scope; the sources do not list other checks

## Fix

- Telerik Report Server: move to `12.3.26.1110` or later

## Timeline

- 2026-11-11T18:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106133

## From the sources

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_