Live › vulnerability › CVE-2026-107187
Go to dashboardArchibus Web Central's AbCommonResources-getDataRecords workflow rule, called over DWR, lets a user read any database table, including afm_users usernames and passwords. Chained with the DWR auth bypass CVE-2026-107186, no login is needed. The finder's PoC is in the Rapid7 post.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Archibus | vendor | < 2025.02 (2025.01 unpatched and all earlier) | 2025.02, 2026.01, 2025.01 + hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.
This page as .md · .json · in your agent: get_signal("CVE-2026-107187")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.