---
id: "CVE-2026-119682"
kind: "vulnerability"
aliases: ["CVE-2026-119682"]
title: "ManageEngine SharePoint Manager Plus: low-privileged users can alter MFA settings"
severity: "high"
cvss: 7.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["manageengine", "mfa", "sharepoint-manager-plus", "vendor"]
not_affected_if: ["build-4507-or-later"]
published_at: "2026-10-30T15:16:51+00:00"
first_seen_at: "2026-10-30T15:31:11+00:00"
updated_at: "2026-10-30T15:33:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119682", "first_seen_at": "2026-10-30T15:31:11+00:00"}]
---

# ManageEngine SharePoint Manager Plus: low-privileged users can alter MFA settings

A low-privileged logged-in user of ManageEngine SharePoint Manager Plus can bypass authorization checks in its multi-factor authentication feature. The attacker can read and change MFA settings, enumerate and delete MFA-enrolled accounts, and lock legitimate users out.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed build number in the SharePoint Manager Plus admin console and compare it with `4507`.
- Review which accounts hold low-privileged roles in the application.

## Fix

- ManageEngine SharePoint Manager Plus: upgrade to build `4507` or later.

## Timeline

- 2026-10-30T15:31:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119682

## From the sources

An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_