---
id: "CVE-2026-106152"
page: "https://infrastack.ai/live/CVE-2026-106152"
kind: "vulnerability"
aliases: ["CVE-2026-106152"]
title: "Telerik Report Server: unauthenticated server address change enables account takeover"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["self-hosted", "telerik-report-server", "vendor", "windows"]
not_affected_if: ["patched-version"]
published_at: "2026-11-11T18:18:24+00:00"
first_seen_at: "2026-11-11T18:28:42+00:00"
updated_at: "2026-11-11T18:29:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106152", "first_seen_at": "2026-11-11T18:28:42+00:00"}]
exploit_sources: []
---

# Telerik Report Server: unauthenticated server address change enables account takeover

Link for people: https://infrastack.ai/live/CVE-2026-106152 (this .md is for agents)

Telerik Report Server before 12.3.26.1110 lets an unauthenticated remote attacker change the server address it uses when building links and notifications. With a user clicking a crafted link, an attacker can read sensitive information and take over accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Report Server version in the admin console or the product's about page against `12.3.26.1110`

## Fix

- Telerik Report Server: move to `12.3.26.1110` or later

## Timeline

- 2026-11-11T18:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106152

## From the sources

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_