{"id":"CVE-2026-114175","kind":"vulnerability","aliases":["CVE-2026-114175"],"related":[],"title":"eRoom Zoom Meetings plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.","summary":"The eRoom Zoom Meetings & Webinar plugin by DigitalME has a missing authorization check, so requests can bypass intended access control levels. An attacker may be able to reach meeting or webinar functions their role should not allow.","severity":"medium","cvss":5.4,"epss":0.00185,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wordpress-plugin","zoom-integration"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the eRoom Zoom Meetings & Webinar plugin in the WordPress plugins list or the plugin's main file header\n- Compare the installed version against `1.7.1`; versions through `1.7.1` are reported as affected\n- Review which user roles can access eRoom meeting and webinar settings","fix":"- Update the eRoom Zoom Meetings & Webinar plugin to a version later than `1.7.1` once the vendor publishes it\n- If no fixed version is available, deactivate the plugin until one is released\n- Restrict plugin access to trusted roles in the meantime","status":"open","published_at":"2026-10-22T07:16:41+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:14:25+00:00","updated_at":"2026-10-25T04:14:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:14:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update the eRoom Zoom Meetings & Webinar plugin to a version later than `1.7.1` once the vendor publishes it\n- If no fixed version is available, deactivate the plugin until one is released\n- Restrict plugin access to trusted roles in the meantime","reach":"unknown","title":"eRoom Zoom Meetings plugin: missing authorization check exposes access controls","impact":"medium","summary":"The eRoom Zoom Meetings & Webinar plugin by DigitalME has a missing authorization check, so requests can bypass intended access control levels. An attacker may be able to reach meeting or webinar functions their role should not allow.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","zoom-integration"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access to meeting or webinar functions under weak access controls","analyst_note":"Confirm the affected plugin versions and the exact privilege the missing check exposes from the NVD entry and the vendor advisory.","how_to_check":"- Check the installed version of the eRoom Zoom Meetings & Webinar plugin in the WordPress plugins list or the plugin's main file header\n- Compare the installed version against `1.7.1`; versions through `1.7.1` are reported as affected\n- Review which user roles can access eRoom meeting and webinar settings","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the eRoom Zoom Meetings & Webinar plugin version 1.7.1 or earlier are in scope, and the sources say the flaw is an incorrectly configured access control level. Sites that do not have the plugin installed can skip this. The sources do not say which default configuration is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":3356,"output_tokens":656,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114175':13A,16A '-2026':12A,15A '1.7.1':87C 'abl':50B 'access':9A,43B,77C 'affect':82C 'allow':61B,73C 'attack':47B 'author':6A,36B,63C 'bypass':41B 'check':7A,37B 'configur':76C 'control':10A,44B,78C 'cve':11A,14A 'digitalm':32B,66C 'eroom':1A,26B,67C,69C,83C 'eroom-zoom-meetings-webinar':68C 'exploit':74C 'expos':8A 'function':56B 'incorrect':75C 'integr':24B 'intend':42B 'issu':81C 'level':45B 'levels.this':80C 'may':48B 'meet':3A,28B,53B,71C 'miss':5A,35B,62C 'n/a':85C 'packag':17B 'plugin':4A,21B,30B 'reach':52B 'request':39B 'role':58B 'secur':79C 'vulner':64C 'webinar':29B,55B,72C 'wordpress':18B,20B 'wordpress-plugin':19B 'zoom':2A,23B,27B,70C 'zoom-integr':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the eRoom Zoom Meetings & Webinar plugin version 1.7.1 or earlier are in scope, and the sources say the flaw is an incorrectly configured access control level. Sites that do not have the plugin installed can skip this. The sources do not say which default configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T07:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114175","severity":null,"published_at":"2026-10-22T07:16:41+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114175","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114175","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}