{"id":"CVE-2026-116393","kind":"vulnerability","aliases":["CVE-2026-116393"],"related":[],"title":"iHomefinder Optima Express: missing authorization exposes access control flaw","description":"Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optima Express: from n/a through 9.0.0.","summary":"Optima Express from iHomefinder, Inc has a missing authorization check, so access control levels can be bypassed. An attacker may reach functions or data that their role should not allow.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ihomefinder","optima-express","real-estate-websites","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Confirm whether the Optima Express plugin or product is installed and note its version.\n- Compare the installed version against the affected range (through 9.0.0) listed in the NVD entry.","fix":"- Update Optima Express to a version later than 9.0.0, as the vendor publishes it (version unknown from sources).\n- Contact iHomefinder for the patched release if no public update is listed.","status":"open","published_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:07+00:00","updated_at":"2026-10-28T13:34:07+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-10-28T13:34:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update Optima Express to a version later than 9.0.0, as the vendor publishes it (version unknown from sources).\n- Contact iHomefinder for the patched release if no public update is listed.","reach":"unknown","title":"iHomefinder Optima Express: missing authorization exposes access control flaw","impact":"medium","summary":"Optima Express from iHomefinder, Inc has a missing authorization check, so access control levels can be bypassed. An attacker may reach functions or data that their role should not allow.","category":"vendor","nicknames":[],"who_cares":["optima-express","ihomefinder","real-estate-websites"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker bypasses access controls and reads or changes restricted data.","analyst_note":"Find the vendor advisory or NVD CPE data to confirm the fixed version, the affected endpoints, and whether authentication is required.","how_to_check":"- Confirm whether the Optima Express plugin or product is installed and note its version.\n- Compare the installed version against the affected range (through 9.0.0) listed in the NVD entry.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites or systems running Optima Express through version 9.0.0 are potentially affected, especially where access levels separate user roles. The sources do not say which deployment paths are exposed, so teams using a hosted or differently configured product should confirm with the vendor.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000598,"input_tokens":3284,"output_tokens":539,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116393':12A,15A '-2026':11A,14A '9.0.0':81C 'access':7A,36B,70C 'affect':75C 'allow':54B,66C 'attack':43B 'author':5A,33B,56C 'bypass':41B 'check':34B 'configur':69C 'control':8A,37B,71C 'cve':10A,13A 'data':48B 'estat':22B 'exploit':67C 'expos':6A 'express':3A,19B,26B,62C,65C,77C 'flaw':9A 'function':46B 'ihomefind':1A,16B,28B,59C 'inc':29B,60C 'incorrect':68C 'issu':74C 'level':38B 'levels.this':73C 'may':44B 'miss':4A,32B,55C 'n/a':79C 'optima':2A,18B,25B,61C,64C,76C 'optima-express':17B,63C 'reach':45B 'real':21B 'real-estate-websit':20B 'role':51B 'secur':72C 'vendor':24B 'vulner':57C 'websit':23B","nicknames":[],"mitigations":[],"who_affected":"Sites or systems running Optima Express through version 9.0.0 are potentially affected, especially where access levels separate user roles. The sources do not say which deployment paths are exposed, so teams using a hosted or differently configured product should confirm with the vendor.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116393","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116393","severity":null,"published_at":"2026-10-28T13:17:05+00:00","modified_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}