{"id":"CVE-2026-106152","kind":"vulnerability","aliases":["CVE-2026-106152"],"related":[],"title":"Telerik Report Server: unauthenticated server address change enables account takeover","description":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.","summary":"Telerik Report Server before 12.3.26.1110 lets an unauthenticated remote attacker change the server address it uses when building links and notifications. With a user clicking a crafted link, an attacker can read sensitive information and take over accounts.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["self-hosted","telerik-report-server","vendor","windows"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed Report Server version in the admin console or the product's about page against `12.3.26.1110`","fix":"- Telerik Report Server: move to `12.3.26.1110` or later","status":"open","published_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","triaged_at":"2026-11-11T18:29:15+00:00","updated_at":"2026-11-11T18:29:15+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T18:29:15Z","model":"claude-haiku-5-5","output":{"fix":"- Telerik Report Server: move to `12.3.26.1110` or later","reach":"internet","title":"Telerik Report Server: unauthenticated server address change enables account takeover","impact":"high","summary":"Telerik Report Server before 12.3.26.1110 lets an unauthenticated remote attacker change the server address it uses when building links and notifications. With a user clicking a crafted link, an attacker can read sensitive information and take over accounts.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["telerik-report-server","self-hosted","windows"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"account takeover and disclosure of sensitive information after a user clicks","analyst_note":"Confirm the exact affected versions and any vendor advisory or workaround at https://nvd.nist.gov/vuln/detail/CVE-2026-106152 before relying on the fix range.","how_to_check":"- Check the installed Report Server version in the admin console or the product's about page against `12.3.26.1110`\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"Telerik Report Server","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Organisations running Telerik Report Server before 12.3.26.1110 are exposed, particularly if the server is reachable from the internet or untrusted networks. The sources do not say which configurations are default, so whether a given install is exposed is unknown.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4559,"output_tokens":569,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-106152':13A,16A '-2026':12A,15A '12.3.26.1110':30B,72C 'account':9A,63B,113C 'address':6A,39B,91C 'allow':82C 'attack':35B,55B,86C 'build':43B 'chang':7A,36B 'click':50B 'configur':79C 'control':75C 'craft':52B 'cve':11A,14A 'disclosur':108C 'enabl':8A 'extern':74C 'generat':97C 'host':19B 'influenc':88C 'inform':59B,111C 'interact':103C 'lead':106C 'let':31B 'link':44B,53B,98C 'notif':46B,100C 'prior':69C 'progress':65C 'read':57B 'remot':34B,85C 'report':2A,22B,27B,67C,94C 'self':18B 'self-host':17B 'sensit':58B,110C 'server':3A,5A,23B,28B,38B,68C,90C,95C 'set':80C 'system':78C 'take':61B 'takeov':10A,114C 'telerik':1A,21B,26B,66C 'telerik-report-serv':20B 'unauthent':4A,33B,84C 'use':41B,92C 'user':49B,102C 'vendor':24B 'version':71C 'vulner':81C 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Organisations running Telerik Report Server before 12.3.26.1110 are exposed, particularly if the server is reachable from the internet or untrusted networks. The sources do not say which configurations are default, so whether a given install is exposed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","selfhosted","telerikreportserver","vendor","windows"],"campaign_type":null,"search_a":"'-106152':13A,16A '-2026':12A,15A 'account':9A 'address':6A 'chang':7A 'cve':11A,14A 'enabl':8A 'report':2A 'server':3A,5A 'takeov':10A 'telerik':1A 'unauthent':4A","search_b":"'12.3.26.1110':30B 'account':63B 'address':39B 'attack':35B,55B 'build':43B 'chang':36B 'click':50B 'craft':52B 'host':19B 'inform':59B 'let':31B 'link':44B,53B 'notif':46B 'read':57B 'remot':34B 'report':22B,27B 'self':18B 'self-host':17B 'sensit':58B 'server':23B,28B,38B 'take':61B 'telerik':21B,26B 'telerik-report-serv':20B 'unauthent':33B 'use':41B 'user':49B 'vendor':24B 'window':25B","search_c":"'12.3.26.1110':72C 'account':113C 'address':91C 'allow':82C 'attack':86C 'configur':79C 'control':75C 'disclosur':108C 'extern':74C 'generat':97C 'influenc':88C 'inform':111C 'interact':103C 'lead':106C 'link':98C 'notif':100C 'prior':69C 'progress':65C 'remot':85C 'report':67C,94C 'sensit':110C 'server':68C,90C,95C 'set':80C 'system':78C 'takeov':114C 'telerik':66C 'unauthent':84C 'use':92C 'user':102C 'version':71C 'vulner':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106152","severity":null,"published_at":"2026-11-11T18:18:24+00:00","modified_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","fetched_at":"2026-11-11T18:28:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}