{"id":"CVE-2026-111793","kind":"vulnerability","aliases":["CVE-2026-111793"],"related":[],"title":"Openwave Webtop Media Transcoder ignores admin file type limits for conversion","description":"Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.","summary":"Openwave Webtop Media Transcoder does not enforce the file-type restrictions an administrator sets for conversion. An authenticated user who bypasses the Webmail interface can convert document types the administrator meant to block.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","openwave-webtop","self-hosted"],"not_affected_if":["no-file-type-restrictions-configured"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T19:17:05+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:39:54+00:00","updated_at":"2026-10-25T04:39:54+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:39:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Openwave Webtop Media Transcoder ignores admin file type limits for conversion","impact":"low","summary":"Openwave Webtop Media Transcoder does not enforce the file-type restrictions an administrator sets for conversion. An authenticated user who bypasses the Webmail interface can convert document types the administrator meant to block.","category":"infrastructure","nicknames":[],"who_cares":["openwave-webtop","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"authenticated users convert file types that administrators meant to block","analyst_note":"Find the vendor advisory or the NVD entry's affected version range and the fixed release for Openwave Webtop Media Transcoder.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-file-type-restrictions-configured"],"who_is_affected":"Organisations running Openwave Webtop Media Transcoder with administrator-defined file type restrictions. The sources do not name affected versions or say whether direct access to the transcoder is exposed beyond the Webmail front end.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000544,"input_tokens":3296,"output_tokens":429,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111793':14A,17A '-2026':13A,16A 'admin':6A 'administr':38B,55B,67C 'administrator-defin':66C 'allow':83C 'authent':43B,85C 'block':58B 'bypass':46B,95C 'convers':11A,41B 'convert':51B,80C,90C 'cve':12A,15A 'defin':68C 'document':52B,92C 'enforc':31B,65C 'experi':98C 'file':7A,34B,69C,76C 'file-typ':33B,75C 'host':24B 'ignor':5A 'infrastructur':18B 'interfac':49B 'limit':9A 'may':82C 'meant':56B 'media':3A,27B,61C 'openwav':1A,20B,25B,59C 'openwave-webtop':19B 'process':88C 'restrict':36B,71C,73C 'self':23B 'self-host':22B 'set':39B 'transcod':4A,28B,62C 'type':8A,35B,53B,70C,77C,93C 'unintend':91C 'user':44B,86C 'webmail':48B,97C 'webtop':2A,21B,26B,60C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Openwave Webtop Media Transcoder with administrator-defined file type restrictions. The sources do not name affected versions or say whether direct access to the transcoder is exposed beyond the Webmail front end.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T19:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111793","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111793","severity":null,"published_at":"2026-10-16T19:17:05+00:00","modified_at":"2026-10-19T16:17:04+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}