{"id":"CVE-2026-94249","kind":"vulnerability","aliases":["CVE-2026-94249"],"related":[],"title":"Liderahenk: missing authorization lets users abuse privileges before 2.0.3","description":"Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse.\n\nThis issue affects Liderahenk: before 2.0.3.","summary":"Liderahenk, a management product from TÜBİTAK BİLGEM, does not check authorization on some functions, so a user can perform actions they should not. The sources say an attacker can abuse privileges, but do not describe the exact actions.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["liderahenk","other","self-hosted"],"not_affected_if":["version-2.0.3-or-later"],"how_to_check":"- Check the installed Liderahenk version; the sources say versions before `2.0.3` are affected","fix":"- Liderahenk: move to `2.0.3` or later (per the description)","status":"open","published_at":"2026-11-09T09:16:59+00:00","first_seen_at":"2026-11-09T09:25:32+00:00","triaged_at":"2026-11-09T09:26:13+00:00","updated_at":"2026-11-09T09:26:13+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T09:26:13Z","model":"claude-haiku-5-5","output":{"fix":"- Liderahenk: move to `2.0.3` or later (per the description)","reach":"unknown","title":"Liderahenk: missing authorization lets users abuse privileges before 2.0.3","impact":"medium","summary":"Liderahenk, a management product from TÜBİTAK BİLGEM, does not check authorization on some functions, so a user can perform actions they should not. The sources say an attacker can abuse privileges, but do not describe the exact actions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["liderahenk","self-hosted"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Users gain privileges they should not have on the server","analyst_note":"Confirm which functions lack authorization, what roles are needed, and the advisory from the NVD entry or the vendor.","how_to_check":"- Check the installed Liderahenk version; the sources say versions before `2.0.3` are affected\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-2.0.3-or-later"],"who_is_affected":"Organisations running Liderahenk versions before 2.0.3 are exposed. The sources do not say which roles or deployment settings make the flaw reachable, so the team should confirm that from the vendor's page.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000701,"input_tokens":4538,"output_tokens":494,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-94249':12A,15A '2.0.3':9A,78C 'abus':6A,50B,72C 'action':40B,58B 'affect':75C 'allow':70C 'attack':48B 'author':3A,31B,60C 'bilgem':27B,64C 'check':30B 'cve':10A,13A 'describ':55B 'exact':57B 'function':34B 'host':20B 'institut':68C 'issu':74C 'let':4A 'liderahenk':1A,16B,21B,69C,76C 'manag':23B 'miss':2A,59C 'perform':39B 'privileg':7A,51B,71C 'product':24B 'research':67C 'say':46B 'self':19B 'self-host':18B 'softwar':65C 'sourc':45B 'technolog':66C 'tübitak':26B,63C 'user':5A,37B 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Liderahenk versions before 2.0.3 are exposed. The sources do not say which roles or deployment settings make the flaw reachable, so the team should confirm that from the vendor's page.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","liderahenk","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-94249':12A,15A '2.0.3':9A 'abus':6A 'author':3A 'cve':10A,13A 'let':4A 'liderahenk':1A 'miss':2A 'privileg':7A 'user':5A","search_b":"'abus':50B 'action':40B,58B 'attack':48B 'author':31B 'bilgem':27B 'check':30B 'describ':55B 'exact':57B 'function':34B 'host':20B 'liderahenk':16B,21B 'manag':23B 'perform':39B 'privileg':51B 'product':24B 'say':46B 'self':19B 'self-host':18B 'sourc':45B 'tübitak':26B 'user':37B","search_c":"'2.0.3':78C 'abus':72C 'affect':75C 'allow':70C 'author':60C 'bilgem':64C 'institut':68C 'issu':74C 'liderahenk':69C,76C 'miss':59C 'privileg':71C 'research':67C 'softwar':65C 'technolog':66C 'tübitak':63C 'vulner':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T09:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94249","severity":null,"published_at":"2026-11-09T09:16:59+00:00","modified_at":"2026-11-09T09:16:59+00:00","first_seen_at":"2026-11-09T09:25:32+00:00","fetched_at":"2026-11-09T09:25:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}