---
id: "CVE-2026-89293"
kind: "vulnerability"
aliases: ["CVE-2026-89293"]
title: "Eclipse Mnestix Browser: unauthenticated users can perform privileged actions"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["asset-administration-shell", "industrial", "mnestix", "package"]
not_affected_if: ["version-2.3.0-or-later"]
published_at: "2026-11-03T10:17:20+00:00"
first_seen_at: "2026-11-03T10:20:16+00:00"
updated_at: "2026-11-03T10:20:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89293", "first_seen_at": "2026-11-03T10:20:16+00:00"}]
---

# Eclipse Mnestix Browser: unauthenticated users can perform privileged actions

Eclipse Mnestix Browser versions 1.2.0 up to but excluding 2.3.0 let an unauthenticated attacker run actions meant only for authorized users. The examples given are changing Infrastructure settings and calling the connected Mnestix AAS Generator backend.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the deployed Mnestix Browser version; the sources say versions 1.2.0 up to but excluding `2.3.0` are affected

## Fix

- Move Mnestix Browser to `2.3.0` or later

## Timeline

- 2026-11-03T10:20:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89293

## From the sources

In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_