{"id":"CVE-2026-121191","kind":"vulnerability","aliases":["CVE-2026-121191"],"related":[],"title":"eta-remote: missing authorization lets users reach restricted functionality","description":"Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects eta-remote: from 0.0.2 before 0.0.3.","summary":"eta-remote, a TÜBİTAK BİLGEM package, fails to enforce access control on some functionality in versions from 0.0.2 before 0.0.3. An attacker can reach functions they should not be allowed to use.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eta-remote","javascript","package"],"not_affected_if":["not-using-eta-remote"],"how_to_check":"- Check the installed eta-remote version in the project manifest or lockfile, for example `npm ls eta-remote` if it is an npm package","fix":"- eta-remote: move to `0.0.3` or later","status":"open","published_at":"2026-11-10T12:17:17+00:00","first_seen_at":"2026-11-10T12:21:53+00:00","triaged_at":"2026-11-10T12:22:40+00:00","updated_at":"2026-11-10T12:22:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T12:22:40Z","model":"claude-haiku-5-5","output":{"fix":"- eta-remote: move to `0.0.3` or later","reach":"unknown","title":"eta-remote: missing authorization lets users reach restricted functionality","impact":"medium","summary":"eta-remote, a TÜBİTAK BİLGEM package, fails to enforce access control on some functionality in versions from 0.0.2 before 0.0.3. An attacker can reach functions they should not be allowed to use.","audience":"developers","category":"package","nicknames":[],"who_cares":["eta-remote","javascript"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unauthorized users reach restricted functionality in the package","analyst_note":"Confirm the ecosystem and the exposed functions for eta-remote from the NVD entry or the advisory, and whether a fix is published.","how_to_check":"- Check the installed eta-remote version in the project manifest or lockfile, for example `npm ls eta-remote` if it is an npm package\n- unknown for other checks; the sources do not say which functions are exposed","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-using-eta-remote"],"who_is_affected":"Affects eta-remote versions from 0.0.2 before 0.0.3. The sources do not describe the data path or configuration that exposes the functionality, so exposure is unknown. Projects that do not depend on eta-remote can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4558,"output_tokens":524,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121191':13A,16A '-2026':12A,15A '0.0.2':40B,83C '0.0.3':42B,85C 'access':32B,69C 'acl':75C 'affect':78C 'allow':52B,68C 'attack':44B 'author':5A,56C 'bilgem':27B,60C 'constrain':73C 'control':33B 'cve':11A,14A 'enforc':31B 'eta':2A,18B,23B,66C,80C 'eta-remot':1A,17B,22B,65C,79C 'fail':29B 'function':10A,36B,47B,70C 'institut':64C 'issu':77C 'javascript':20B 'let':6A 'miss':4A,55C 'packag':21B,28B 'proper':72C 'reach':8A,46B 'remot':3A,19B,24B,67C,81C 'research':63C 'restrict':9A 'softwar':61C 'technolog':62C 'tübitak':26B,59C 'use':54B 'user':7A 'version':38B 'vulner':57C","nicknames":[],"mitigations":[],"who_affected":"Affects eta-remote versions from 0.0.2 before 0.0.3. The sources do not describe the data path or configuration that exposes the functionality, so exposure is unknown. Projects that do not depend on eta-remote can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["etaremote","javascript","medium","package"],"campaign_type":null,"search_a":"'-121191':13A,16A '-2026':12A,15A 'author':5A 'cve':11A,14A 'eta':2A 'eta-remot':1A 'function':10A 'let':6A 'miss':4A 'reach':8A 'remot':3A 'restrict':9A 'user':7A","search_b":"'0.0.2':40B '0.0.3':42B 'access':32B 'allow':52B 'attack':44B 'bilgem':27B 'control':33B 'enforc':31B 'eta':18B,23B 'eta-remot':17B,22B 'fail':29B 'function':36B,47B 'javascript':20B 'packag':21B,28B 'reach':46B 'remot':19B,24B 'tübitak':26B 'use':54B 'version':38B","search_c":"'0.0.2':83C '0.0.3':85C 'access':69C 'acl':75C 'affect':78C 'allow':68C 'author':56C 'bilgem':60C 'constrain':73C 'eta':66C,80C 'eta-remot':65C,79C 'function':70C 'institut':64C 'issu':77C 'miss':55C 'proper':72C 'remot':67C,81C 'research':63C 'softwar':61C 'technolog':62C 'tübitak':59C 'vulner':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121191","severity":null,"published_at":"2026-11-10T12:17:17+00:00","modified_at":"2026-11-10T12:17:17+00:00","first_seen_at":"2026-11-10T12:21:53+00:00","fetched_at":"2026-11-10T12:21:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}