---
id: "CVE-2026-107186"
kind: "vulnerability"
aliases: ["CVE-2026-107186"]
title: "Unauthenticated DWR request runs workflow rules without authentication"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Archibus Web Central", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}]
ecosystems: []
tags: ["archibus", "dwr", "eptura", "java", "package", "self-hosted"]
not_affected_if: ["not-internet-exposed"]
published_at: "2026-10-19T17:17:00+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-24T00:21:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107186", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:21:42+00:00"}]
---

# Unauthenticated DWR request runs workflow rules without authentication

Eptura Archibus Web Central: a pre-auth DWR method (SecurityService.isPasswordUppercase) leaves a privileged core user session on the request thread. A second call in the same batch, runWorkflowRule, then runs with that session. An unauthenticated attacker can run workflow rules. Rapid7 chained this to read the database (CVE-2026-107187) and write files for RCE (CVE-2026-107188).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Archibus Web Central affected unknown fixed ?

## How to check

Find out whether you run Archibus Web Central, i.e. whether /archibus/login.axvw responds on your server. Check the installed version against Eptura's patch notes. Review web server logs for POSTs to /archibus/dwr/call/plaincall/ whose body has callCount=2 or higher and names SecurityService isPasswordUppercase. Look for unexpected files in browsable directories.

## Fix

Unknown: no fixed version read. Rapid7 labels the issue FIXED, so get the patched Archibus release from Eptura support. Until then, block /archibus/ from the internet or restrict access to the DWR endpoints at the reverse proxy.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107186
- 2026-10-24T00:21:42+00:00 analyst — Product is Eptura Archibus Web Central (Rapid7 CNA, advisory by Marcus Chang, 2026-10-19). Affected and fixed versions not stated on pages I read; Rapid7 post is titled FIXED but OpenCVE says no remediation. Settle with Eptura release notes. No public exploit seen, so exploited stays false. Chains with CVE-2026-107187 (DB read) and CVE-2026-107188 (file upload, RCE); sibling signals may exist.

## Documents

- [advisory] Rapid7: Auth Bypass, RCE, and Database Read in Eptura Archibus https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/

## From the sources

An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_