CVE-2026-107484 · Infrastructure
NO FIX YET
Gaia Portal backend handlers fail to validate input and authorization properly. An authenticated user without administrator rights can perform privileged operations reserved for administrators.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Check Point Gaia (the OS on Check Point gateways and management servers) with the Gaia Portal web interface enabled and non-administrator accounts that can log in. Per the CVSS vector from Check Point (AV:A, PR:L) the attacker must be on an adjacent network and hold a valid low-privilege login. Affected versions are not published yet. Systems with no non-admin Gaia accounts, or with Portal access limited to trusted admin hosts, are less exposed.
Not affected if no-non-admin-accounts
Who cares check-point, firewall, gaia-portal
No fix yet, per the sources.
An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user to perform privileged operations that should be restricted to administrators.
This page as .md · .json · CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.