{"id":"CVE-2026-107400","kind":"vulnerability","aliases":["CVE-2026-107400"],"related":[],"title":"IBM TRIRIGA: authenticated user can execute arbitrary code remotely","description":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.","summary":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 has an improper authentication flaw (GWT Mock Authentication). A remote attacker with a valid low-privilege account can execute arbitrary code on the server. CVSS 8.8. IBM lists no workaround.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM TRIRIGA Application Platform","fixed":["5.0.9"],"affected":">= 5.0.0, <= 5.0.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise-apps","ibm-tririga","other","self-hosted"],"not_affected_if":["version-outside-5.0.0-5.0.8"],"how_to_check":"Check the installed TRIRIGA Application Platform version in the admin console or install files. Versions 5.0.0 through 5.0.8 are affected.","fix":"Upgrade to IBM TRIRIGA Application Platform 5.0.9 or a later supported release (IBM Fix Central). IBM lists no workarounds; until patched, limit who has TRIRIGA accounts and restrict network access.","status":"open","published_at":"2026-10-20T00:17:25+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:32:59+00:00","updated_at":"2026-10-24T00:19:02+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-23T22:32:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM TRIRIGA: authenticated user can execute arbitrary code remotely","impact":"high","summary":"IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 have an improper authentication flaw. A remote attacker with a valid account can run arbitrary code on the server.","category":"other","who_cares":["ibm-tririga","enterprise-apps"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the server with a low-privilege account","analyst_note":"Find IBM's security bulletin for CVE-2026-107400 to get the fixed version and any workaround; the NVD entry alone does not give them.","how_to_check":"Check the installed TRIRIGA Application Platform version against 5.0.0 through 5.0.8.","needs_analyst":true,"not_affected_if":["version-outside-5.0.0-5.0.8"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000475,"input_tokens":2880,"output_tokens":374,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-107400 to get the fixed version and any workaround; the NVD entry alone does not give them.","search":"'-107400':12A,15A '-2026':11A,14A '5.0.0':34B,72C '5.0.8':36B,74C '8.8':63B 'account':54B 'allow':76C 'app':22B 'applic':32B,70C 'application':18A 'arbitrari':7A,57B,83C 'attack':47B,80C 'authent':3A,40B,44B,79C,88C 'code':8A,58B,84C 'could':75C 'cve':10A,13A 'cvss':62B 'due':85C 'enterpris':21B 'enterprise-app':20B 'execut':6A,56B,82C 'flaw':41B 'gwt':42B 'host':29B 'ibm':1A,16A,24B,30B,64B,68C 'ibm-tririga':23B 'improp':39B,87C 'list':65B 'low':52B 'low-privileg':51B 'mock':43B 'platform':19A,33B,71C 'privileg':53B 'remot':9A,46B,78C 'self':28B 'self-host':27B 'server':61B 'tririga':2A,17A,25B,31B,69C 'user':4A 'valid':50B 'workaround':67B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T00:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107400","severity":null,"published_at":"2026-10-20T00:17:25+00:00","modified_at":"2026-10-20T15:03:59+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107400:634","url":null,"severity":null,"published_at":"2026-10-24T00:19:02+00:00","modified_at":"2026-10-24T00:19:02+00:00","first_seen_at":"2026-10-24T00:19:02+00:00","fetched_at":"2026-10-24T00:19:02+00:00","note":"IBM bulletin read (GWT Mock Authentication, CWE-287, CVSS 8.8): affected 5.0.0-5.0.8, fixed 5.0.9, no workaround. No exploitation or PoC seen; social search skipped (niche product)."}],"documents":[{"id":2541,"url":"https://www.ibm.com/support/pages/security-bulletin-security-vulnerability-identified-ibm-tririga-gwt-mock-authentication-0","title":"IBM Security Bulletin: TRIRIGA GWT Mock Authentication (CVE-2026-107400)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}