{"id":"CVE-2026-121267","kind":"vulnerability","aliases":["CVE-2026-121267"],"related":[],"title":"eta-remote: incorrect default permissions let users reach restricted functions","description":"Incorrect default permissions vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects eta-remote: from 0.0.2 before 0.0.3.","summary":"eta-remote, a TÜBİTAK BİLGEM product, ships with incorrect default permissions that let callers reach functionality not properly restricted by access control lists. An attacker who can reach the service may use features they should not have access to.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"eta-remote","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["eta-remote","other"],"not_affected_if":["version-0.0.3-or-later"],"how_to_check":"- Check the installed eta-remote version and whether it falls in the affected range `0.0.2` to before `0.0.3`\n- Review the access control or permission settings the product applies by default, since the sources do not name the exact setting","fix":"- eta-remote: move to `0.0.3` or later","status":"open","published_at":"2026-11-10T13:18:22+00:00","first_seen_at":"2026-11-10T13:22:03+00:00","triaged_at":"2026-11-10T13:23:31+00:00","updated_at":"2026-11-10T13:23:31+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T13:23:31Z","model":"claude-haiku-5-5","output":{"fix":"- eta-remote: move to `0.0.3` or later","reach":"unknown","title":"eta-remote: incorrect default permissions let users reach restricted functions","impact":"medium","summary":"eta-remote, a TÜBİTAK BİLGEM product, ships with incorrect default permissions that let callers reach functionality not properly restricted by access control lists. An attacker who can reach the service may use features they should not have access to.","audience":"businesses","category":"other","nicknames":[],"who_cares":["eta-remote"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unauthorized callers reach restricted functionality","analyst_note":"Confirm the exact exposure, reach and default setting from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121267 and any vendor advisory.","how_to_check":"- Check the installed eta-remote version and whether it falls in the affected range `0.0.2` to before `0.0.3`\n- Review the access control or permission settings the product applies by default, since the sources do not name the exact setting","plain_action":"","product_name":"eta-remote","needs_analyst":true,"not_affected_if":["version-0.0.3-or-later"],"who_is_affected":"Teams running eta-remote versions from 0.0.2 up to but not including 0.0.3 are affected. The sources do not say which deployment setups expose the flawed default permissions, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4559,"output_tokens":560,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121267':14A,17A '-2026':13A,16A '0.0.2':92C '0.0.3':94C 'access':45B,62B,78C 'acl':84C 'affect':87C 'allow':77C 'attack':49B 'bilgem':29B,69C 'caller':38B 'constrain':82C 'control':46B 'cve':12A,15A 'default':5A,34B,64C 'eta':2A,19A,22B,25B,75C,89C 'eta-remot':1A,21B,24B,74C,88C 'eta-remote':18A 'featur':57B 'function':11A,40B,79C 'incorrect':4A,33B,63C 'institut':73C 'issu':86C 'let':7A,37B 'list':47B 'may':55B 'permiss':6A,35B,65C 'product':30B 'proper':42B,81C 'reach':9A,39B,52B 'remot':3A,23B,26B,76C,90C 'remote':20A 'research':72C 'restrict':10A,43B 'servic':54B 'ship':31B 'softwar':70C 'technolog':71C 'tübitak':28B,68C 'use':56B 'user':8A 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Teams running eta-remote versions from 0.0.2 up to but not including 0.0.3 are affected. The sources do not say which deployment setups expose the flawed default permissions, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["etaremote"],"ptokens":["eta","remote"],"labels":["etaremote","high","other","vendor"],"campaign_type":null,"search_a":"'-121267':14A,17A '-2026':13A,16A 'cve':12A,15A 'default':5A 'eta':2A,19A 'eta-remot':1A 'eta-remote':18A 'function':11A 'incorrect':4A 'let':7A 'permiss':6A 'reach':9A 'remot':3A 'remote':20A 'restrict':10A 'user':8A","search_b":"'access':45B,62B 'attack':49B 'bilgem':29B 'caller':38B 'control':46B 'default':34B 'eta':22B,25B 'eta-remot':21B,24B 'featur':57B 'function':40B 'incorrect':33B 'let':37B 'list':47B 'may':55B 'permiss':35B 'product':30B 'proper':42B 'reach':39B,52B 'remot':23B,26B 'restrict':43B 'servic':54B 'ship':31B 'tübitak':28B 'use':56B","search_c":"'0.0.2':92C '0.0.3':94C 'access':78C 'acl':84C 'affect':87C 'allow':77C 'bilgem':69C 'constrain':82C 'default':64C 'eta':75C,89C 'eta-remot':74C,88C 'function':79C 'incorrect':63C 'institut':73C 'issu':86C 'permiss':65C 'proper':81C 'remot':76C,90C 'research':72C 'softwar':70C 'technolog':71C 'tübitak':68C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T13:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121267","severity":null,"published_at":"2026-11-10T13:18:22+00:00","modified_at":"2026-11-10T13:18:22+00:00","first_seen_at":"2026-11-10T13:22:03+00:00","fetched_at":"2026-11-10T13:22:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}