{"id":"CVE-2026-89293","kind":"vulnerability","aliases":["CVE-2026-89293"],"related":[],"title":"Eclipse Mnestix Browser: unauthenticated users can perform privileged actions","description":"In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.","summary":"Eclipse Mnestix Browser versions 1.2.0 up to but excluding 2.3.0 let an unauthenticated attacker run actions meant only for authorized users. The examples given are changing Infrastructure settings and calling the connected Mnestix AAS Generator backend.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asset-administration-shell","industrial","mnestix","package"],"not_affected_if":["version-2.3.0-or-later"],"how_to_check":"- Check the deployed Mnestix Browser version; the sources say versions 1.2.0 up to but excluding `2.3.0` are affected","fix":"- Move Mnestix Browser to `2.3.0` or later","status":"open","published_at":"2026-11-03T10:17:20+00:00","first_seen_at":"2026-11-03T10:20:16+00:00","triaged_at":"2026-11-03T10:20:32+00:00","updated_at":"2026-11-03T10:20:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T10:20:32Z","model":"claude-haiku-5-5","output":{"fix":"- Move Mnestix Browser to `2.3.0` or later\n- unknown for any other fix detail","reach":"unknown","title":"Eclipse Mnestix Browser: unauthenticated users can perform privileged actions","impact":"high","summary":"Eclipse Mnestix Browser versions 1.2.0 up to but excluding 2.3.0 let an unauthenticated attacker run actions meant only for authorized users. The examples given are changing Infrastructure settings and calling the connected Mnestix AAS Generator backend.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mnestix","asset-administration-shell","industrial"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker changes infrastructure settings and uses the backend without login","analyst_note":"Confirm the exact access path and reachable interfaces for the unauthenticated flaw at https://nvd.nist.gov/vuln/detail/CVE-2026-89293 and the vendor advisory.","how_to_check":"- Check the deployed Mnestix Browser version; the sources say versions 1.2.0 up to but excluding `2.3.0` are affected\n- unknown for any other check, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["version-2.3.0-or-later"],"who_is_affected":"Teams that run Eclipse Mnestix Browser in the affected version range are exposed, since the flaw lets an unauthenticated attacker act with authorized-user rights. The sources do not say whether default configurations or specific deployment setups change exposure. unknown whether a deployment with network restrictions is safe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000725,"input_tokens":4151,"output_tokens":619,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-89293':12A,15A '1.2.0':27B,64C '2.3.0':32B,69C 'aa':56B,104C 'action':9A,38B,79C 'administr':18B 'allow':83C 'asset':17B 'asset-administration-shel':16B 'attack':36B,76C 'authent':102C 'author':42B,89C 'backend':58B,106C 'browser':3A,25B,62C 'call':52B,98C 'chang':48B,93C 'connect':54B,100C 'cve':10A,13A 'eclips':1A,23B,60C 'exampl':45B 'exclud':31B,68C 'execut':86C 'generat':57B,105C 'given':46B 'industri':20B 'infrastructur':49B,95C 'let':33B 'like':92C 'meant':39B 'mnestix':2A,21B,24B,55B,61C,90C,103C 'packag':22B 'perform':7A,78C 'possibl':72C 'privileg':8A 'run':37B 'set':50B,96C 'shell':19B 'unauthent':4A,35B,75C 'user':5A,43B,91C 'version':26B,63C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Eclipse Mnestix Browser in the affected version range are exposed, since the flaw lets an unauthenticated attacker act with authorized-user rights. The sources do not say whether default configurations or specific deployment setups change exposure. unknown whether a deployment with network restrictions is safe.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["assetadministrationshell","high","industrial","mnestix","package"],"first_public_at":"2026-11-03T10:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89293","severity":null,"published_at":"2026-11-03T10:17:20+00:00","modified_at":"2026-11-03T10:17:20+00:00","first_seen_at":"2026-11-03T10:20:16+00:00","fetched_at":"2026-11-03T10:20:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}