{"id":"CVE-2026-107186","kind":"vulnerability","aliases":["CVE-2026-107186"],"related":[],"title":"Unauthenticated DWR request runs workflow rules without authentication","description":"An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.","summary":"Eptura Archibus Web Central: a pre-auth DWR method (SecurityService.isPasswordUppercase) leaves a privileged core user session on the request thread. A second call in the same batch, runWorkflowRule, then runs with that session. An unauthenticated attacker can run workflow rules. Rapid7 chained this to read the database (CVE-2026-107187) and write files for RCE (CVE-2026-107188).","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Archibus Web Central","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["archibus","dwr","eptura","java","package","self-hosted"],"not_affected_if":["not-internet-exposed"],"how_to_check":"Find out whether you run Archibus Web Central, i.e. whether /archibus/login.axvw responds on your server. Check the installed version against Eptura's patch notes. Review web server logs for POSTs to /archibus/dwr/call/plaincall/ whose body has callCount=2 or higher and names SecurityService isPasswordUppercase. Look for unexpected files in browsable directories.","fix":"Unknown: no fixed version read. Rapid7 labels the issue FIXED, so get the patched Archibus release from Eptura support. Until then, block /archibus/ from the internet or restrict access to the DWR endpoints at the reverse proxy.","status":"open","published_at":"2026-10-19T17:17:00+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:39:45+00:00","updated_at":"2026-10-24T00:21:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:39:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Unauthenticated DWR request runs workflow rules without authentication","impact":"medium","summary":"An unauthenticated user can craft a DWR request that chains an isPasswordUppercase call with a run-workflow-rule call. The attacker can trigger workflow rules without logging in.","category":"package","who_cares":["dwr","java"],"confidence":0.5,"needs_auth":"no","worst_case":"unauthenticated attacker triggers workflow rules, impact on data unknown","analyst_note":"Sources do not name the product or versions affected; find the vendor advisory at the NVD link to confirm the product, fixed version and check steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000439,"input_tokens":2871,"output_tokens":303,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not name the product or versions affected; find the vendor advisory at the NVD link to confirm the product, fixed version and check steps.","search":"'-107186':11A,14A '-107187':76B '-107188':84B '-2026':10A,13A,75B,83B 'allow':113C 'archibus':15A,18B,27B 'attack':62B 'auth':33B 'authent':8A,121C 'batch':53B 'call':49B,97C,102C 'central':17A,29B 'chain':68B 'core':40B 'cve':9A,12A,74B,82B 'databas':73B 'dwr':2A,19B,34B,91C 'eptura':20B,26B 'file':79B 'host':25B 'ispassworduppercas':94C 'java':21B 'leav':37B 'method':35B,98C,103C 'next':101C 'one':96C 'packag':22B 'pre':32B 'pre-auth':31B 'privileg':39B 'rapid7':67B 'rce':81B 'read':71B 'request':3A,45B,92C 'rule':6A,66B,111C,116C 'run':4A,56B,64B,109C,119C 'runworkflowrul':54B 'second':48B 'securityservice.ispassworduppercase':36B 'self':24B 'self-host':23B 'send':89C 'session':42B,59B 'set':106C 'thread':46B 'unauthent':1A,61B,86C 'user':41B,87C 'web':16A,28B 'without':7A,120C 'workflow':5A,65B,110C,115C 'write':78B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107186","severity":null,"published_at":"2026-10-19T17:17:00+00:00","modified_at":"2026-10-20T20:17:13+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107186:643","url":null,"severity":null,"published_at":"2026-10-24T00:21:42+00:00","modified_at":"2026-10-24T00:21:42+00:00","first_seen_at":"2026-10-24T00:21:42+00:00","fetched_at":"2026-10-24T00:21:42+00:00","note":"Product is Eptura Archibus Web Central (Rapid7 CNA, advisory by Marcus Chang, 2026-10-19). Affected and fixed versions not stated on pages I read; Rapid7 post is titled FIXED but OpenCVE says no remediation. Settle with Eptura release notes. No public exploit seen, so exploited stays false. Chains with CVE-2026-107187 (DB read) and CVE-2026-107188 (file upload, RCE); sibling signals may exist."}],"documents":[{"id":1954,"url":"https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/","title":"Rapid7: Auth Bypass, RCE, and Database Read in Eptura Archibus","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}