{"id":"CVE-2026-114176","kind":"vulnerability","aliases":["CVE-2026-114176"],"related":[],"title":"DigitalME eRoom Zoom meetings plugin: missing authorization check, versions through 1.7.1","description":"Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.","summary":"The eRoom Zoom Meetings and Webinar plugin from DigitalME has a missing authorization check, so access control is not enforced on some actions. The sources do not say what data or actions an attacker can reach.","severity":"medium","cvss":4.3,"epss":0.0021,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","zoom-integration"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the eRoom eroom-zoom-meetings-webinar plugin is installed and at what version (unknown exact command; the sources do not give one)\n- Compare the installed version against 1.7.1; versions up to and including `1.7.1` are listed as affected","fix":"- Update the eRoom Zoom Meetings and Webinar plugin to a version later than `1.7.1` once the vendor publishes one (unknown: the sources do not name a fixed version)\n- If no fixed version exists, disable the plugin (unknown: no vendor guidance in the sources)","status":"open","published_at":"2026-10-21T18:17:26+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:37:39+00:00","updated_at":"2026-10-25T04:37:39+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T04:37:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update the eRoom Zoom Meetings and Webinar plugin to a version later than `1.7.1` once the vendor publishes one (unknown: the sources do not name a fixed version)\n- If no fixed version exists, disable the plugin (unknown: no vendor guidance in the sources)","reach":"unknown","title":"DigitalME eRoom Zoom meetings plugin: missing authorization check, versions through 1.7.1","impact":"medium","summary":"The eRoom Zoom Meetings and Webinar plugin from DigitalME has a missing authorization check, so access control is not enforced on some actions. The sources do not say what data or actions an attacker can reach.","category":"package","nicknames":[],"who_cares":["wordpress","zoom-integration"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown access to plugin functions; exact impact not stated","analyst_note":"Check the NVD entry and the vendor or WordPress plugin page for the affected endpoint, required role and a fixed version.","how_to_check":"- Check whether the eRoom eroom-zoom-meetings-webinar plugin is installed and at what version (unknown exact command; the sources do not give one)\n- Compare the installed version against 1.7.1; versions up to and including `1.7.1` are listed as affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the eRoom eroom-zoom-meetings-webinar plugin at version 1.7.1 or earlier are affected. The sources do not say which roles or endpoints are involved, so whether an account is needed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000639,"input_tokens":3356,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114176':14A,17A '-2026':13A,16A '1.7.1':11A,84C 'access':38B,74C 'action':45B,54B 'affect':79C 'allow':70C 'attack':56B 'author':7A,35B,60C 'check':8A,36B 'configur':73C 'control':39B,75C 'cve':12A,15A 'data':52B 'digitalm':1A,31B,63C 'enforc':42B 'eroom':2A,24B,64C,66C,80C 'eroom-zoom-meetings-webinar':65C 'exploit':71C 'incorrect':72C 'integr':22B 'issu':78C 'levels.this':77C 'meet':4A,26B,68C 'miss':6A,34B,59C 'n/a':82C 'packag':18B 'plugin':5A,29B 'reach':58B 'say':50B 'secur':76C 'sourc':47B 'version':9A 'vulner':61C 'webinar':28B,69C 'wordpress':19B 'zoom':3A,21B,25B,67C 'zoom-integr':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the eRoom eroom-zoom-meetings-webinar plugin at version 1.7.1 or earlier are affected. The sources do not say which roles or endpoints are involved, so whether an account is needed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114176","severity":null,"published_at":"2026-10-21T18:17:26+00:00","modified_at":"2026-10-22T11:17:38+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114176","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114176","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}