{"id":"CVE-2026-107187","kind":"vulnerability","aliases":["CVE-2026-107187"],"related":[],"title":"Web app: DWR request exposes database usernames and passwords to users","description":"A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.","summary":"Archibus Web Central's AbCommonResources-getDataRecords workflow rule, called over DWR, lets a user read any database table, including afm_users usernames and passwords. Chained with the DWR auth bypass CVE-2026-107186, no login is needed. The finder's PoC is in the Rapid7 post.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Archibus","fixed":["2025.02","2026.01","2025.01 + hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576"],"affected":"< 2025.02 (2025.01 unpatched and all earlier)","ecosystem":"vendor"}],"ecosystems":[],"tags":["archibus","dwr","eptura","facilities-management","java","other","self-hosted","unauthenticated"],"not_affected_if":["archibus-2025.02-or-later","hotfix-applied"],"how_to_check":"Find Archibus Web Central servers (path /archibus/login.axvw, /archibus/dwr/). Check the version in the app: V.2025.01 and earlier are affected, V.2025.02 and V.2026.01 are not. For 2025.01, check that hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576 is installed. Confirm with Eptura or your Archibus partner.","fix":"Upgrade to Archibus V.2025.02 or V.2026.01. On 2025.01 apply hotfix WebCv2025.01.01.128_Hotfix-for-AD-24576 (via the Eptura partner portal). On 2024.04 and earlier (unsupported) apply Eptura's web.xml mitigation from Archibus Support, then upgrade. Per Eptura's notice as relayed by Safeguard; not read directly.","status":"open","published_at":"2026-10-19T17:17:00+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:00:30+00:00","updated_at":"2026-10-25T03:40:27+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-25T03:00:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Web app: DWR request exposes database usernames and passwords to users","impact":"high","summary":"A user can send a crafted DWR request with a specified workflow rule and read database details, including usernames and passwords. The description says this can be chained with an authentication bypass to read the database without logging in, and writes or deletes may be possible but were untested.","category":"other","nicknames":[],"who_cares":["dwr","java"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Database credentials readable; possible unauthenticated database reads and writes","analyst_note":"Identify the affected product from the NVD entry (products field is empty); confirm the vendor, affected versions and fixed release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000495,"input_tokens":3298,"output_tokens":331,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product from the NVD entry (products field is empty); confirm the vendor, affected versions and fixed release.","search":"'-107186':64B '-107187':14A,17A '-2026':13A,16A,63B 'abcommonresourc':36B 'abcommonresources-getdatarecord':35B 'access':81C 'afm':51B 'also':122C 'app':2A 'archibus':18A,19B,31B 'auth':60B 'authent':101C,115C 'bypass':61B,102C 'call':40B 'central':33B 'chain':56B,106C 'cve':12A,15A,62B 'databas':6A,48B,83C,112C,116C 'delet':119C 'detail':84C 'dwr':3A,20B,42B,59B,93C 'eptura':21B 'expos':5A 'facil':23B 'facilities-manag':22B 'finder':70B 'getdatarecord':37B 'host':29B 'includ':50B 'java':25B 'let':43B 'login':66B 'manag':24B 'may':121C 'need':68B 'oper':120C 'password':9A,55B,89C 'perform':111C 'poc':72B 'possibl':124C 'post':77B 'rapid7':76B 'read':46B,113C 'request':4A,94C 'rule':39B,99C 'self':28B 'self-host':27B 'send':91C 'specifi':97C 'tabl':49B 'unauthent':30B 'untest':128C 'user':11A,45B,52B,79C 'usernam':7A,53B,87C 'vulner':103C,109C 'web':1A,32B 'without':114C 'workflow':38B,98C 'write':117C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107187","severity":null,"published_at":"2026-10-19T17:17:00+00:00","modified_at":"2026-10-20T20:17:13+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107187:767","url":null,"severity":null,"published_at":"2026-10-25T03:40:27+00:00","modified_at":"2026-10-25T03:40:27+00:00","first_seen_at":"2026-10-25T03:40:27+00:00","fetched_at":"2026-10-25T03:40:27+00:00","note":"Product is Eptura Archibus Web Central (Rapid7 CNA, finder Marcus Chang). Read Rapid7 write-up (finder, not vendor) with PoC request; fix details come from Safeguard's summary of Eptura's 21 Oct notice, which I could not read directly, so nothing marked verified. No exploitation reported (CISA SSVC none, not in KEV). Same chain as CVE-2026-107186 (auth bypass) and -107188 (RCE)."}],"documents":[{"id":1954,"url":"https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/","title":"Rapid7: Auth Bypass, RCE, and Database Read in Eptura Archibus","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3283,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-107187/","title":"Rapid7 DB: CVE-2026-107187","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1955,"url":"https://safeguard.sh/resources/blog/eptura-archibus-cve-2026-107186-auth-bypass-rce","title":"Safeguard: Eptura Archibus CVE-2026-107186 (summarises Eptura notice)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}