{"id":"CVE-2026-119474","kind":"vulnerability","aliases":["CVE-2026-119474"],"related":[],"title":"HAVELSAN Liman Render Engine: incorrect permissions let users escalate privileges","description":"Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation.\n\nThis issue affects Liman Render Engine: before 1.2-81.","summary":"HAVELSAN's Liman Render Engine assigns permissions incorrectly to a critical resource, which allows privilege escalation. An attacker with access to the software can gain higher privileges than they should have.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["havelsan","liman-render-engine","other"],"not_affected_if":["version-1.2-81-or-later"],"how_to_check":"- Check the installed Liman Render Engine version against the fixed version; the sources do not say where the version is reported.","fix":"- Liman Render Engine: move to `1.2-81` or later","status":"open","published_at":"2026-11-09T15:17:07+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","triaged_at":"2026-11-09T15:28:04+00:00","updated_at":"2026-11-09T15:28:04+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T15:28:04Z","model":"claude-haiku-5-5","output":{"fix":"- Liman Render Engine: move to `1.2-81` or later\n","reach":"unknown","title":"HAVELSAN Liman Render Engine: incorrect permissions let users escalate privileges","impact":"high","summary":"HAVELSAN's Liman Render Engine assigns permissions incorrectly to a critical resource, which allows privilege escalation. An attacker with access to the software can gain higher privileges than they should have.","audience":"businesses","category":"other","nicknames":[],"who_cares":["havelsan","liman-render-engine"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker gains elevated privileges on the affected system.","analyst_note":"Confirm required authentication level, exploit preconditions and the vendor advisory; the NVD entry gives only the affected range.","how_to_check":"- Check the installed Liman Render Engine version against the fixed version; the sources do not say where the version is reported.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-1.2-81-or-later"],"who_is_affected":"Organisations running HAVELSAN Liman Render Engine before version 1.2-81. The sources do not say which deployment roles or configurations are needed to exploit it, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":4528,"output_tokens":489,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119474':13A,16A '-2026':12A,15A '-81':73C '1.2':72C 'access':41B 'affect':67C 'allow':35B,62C 'assign':27B,51C 'attack':39B 'critic':32B,53C 'cve':11A,14A 'engin':4A,21B,26B,61C,70C 'escal':9A,37B,64C 'gain':46B 'havelsan':1A,17B,22B,57C 'higher':47B 'inc':58C 'incorrect':5A,29B,49C 'issu':66C 'let':7A 'liman':2A,19B,24B,59C,68C 'liman-render-engin':18B 'permiss':6A,28B,50C 'privileg':10A,36B,48B,63C 'render':3A,20B,25B,60C,69C 'resourc':33B,54C 'softwar':44B 'user':8A 'vulner':55C","nicknames":[],"mitigations":[],"who_affected":"Organisations running HAVELSAN Liman Render Engine before version 1.2-81. The sources do not say which deployment roles or configurations are needed to exploit it, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["havelsan","high","limanrenderengine","other"],"campaign_type":null,"search_a":"'-119474':13A,16A '-2026':12A,15A 'cve':11A,14A 'engin':4A 'escal':9A 'havelsan':1A 'incorrect':5A 'let':7A 'liman':2A 'permiss':6A 'privileg':10A 'render':3A 'user':8A","search_b":"'access':41B 'allow':35B 'assign':27B 'attack':39B 'critic':32B 'engin':21B,26B 'escal':37B 'gain':46B 'havelsan':17B,22B 'higher':47B 'incorrect':29B 'liman':19B,24B 'liman-render-engin':18B 'permiss':28B 'privileg':36B,48B 'render':20B,25B 'resourc':33B 'softwar':44B","search_c":"'-81':73C '1.2':72C 'affect':67C 'allow':62C 'assign':51C 'critic':53C 'engin':61C,70C 'escal':64C 'havelsan':57C 'inc':58C 'incorrect':49C 'issu':66C 'liman':59C,68C 'permiss':50C 'privileg':63C 'render':60C,69C 'resourc':54C 'vulner':55C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T15:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119474","severity":null,"published_at":"2026-11-09T15:17:07+00:00","modified_at":"2026-11-09T15:17:07+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","fetched_at":"2026-11-09T15:27:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}