CVE-2026-102249

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102249", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-28T19:04:36.570Z", "datePublished": "2026-09-29T03:45:12.603Z", "dateUpdated": "2026-10-01T15:42:12.308Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-29T03:45:12.603Z"}, "title": "REBUILD file-editor-save authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-862", "lang": "en", "description": "Missing Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "Incorrect Authorization"}]}], "affected": [{"vendor": "n/a", "product": "REBUILD", "versions": [{"version": "4.4.0", "status": "affected"}, {"version": "4.4.1", "status": "affected"}, {"version": "4.4.2", "status": "affected"}, {"version": "4.4.3", "status": "affected"}, {"version": "4.4.4", "status": "affected"}, {"version": "4.4.5", "status": "affected"}, {"version": "4.4.6", "status": "affected"}, {"version": "4.4.7", "status": "affected"}, {"version": "4.4.8", "status": "affected"}, {"version": "4.4.9", "status": "affected"}, {"version": "4.4.10", "status": "affected"}, {"version": "4.4.11", "status": "affected"}], "cpes": ["cpe:2.3:a:rebuild:rebuild:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-09-28T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-28T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-28T21:09:47.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "asants (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/411151", "name": "VDB-411151 | REBUILD file-editor-save authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/411151/cti", "name": "VDB-411151 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-102249", "name": "CVE-2026-102249 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/933733", "name": "Submit #933733 | REBUILD 4.4.7-release Improper Authorization", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ASantsSec/CVE/issues/26", "tags": ["exploit", "issue-tracking"]}], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-01T15:41:46.473837Z", "id": "CVE-2026-102249", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T15:42:12.308Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102249", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-01T15:41:46.473837Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T15:41:53.047Z"}}], "cna": {"title": "REBUILD file-editor-save authorization", "credits": [{"lang": "en", "type": "reporter", "value": "asants (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:rebuild:rebuild:*:*:*:*:*:*:*:*"], "vendor": "n/a", "product": "REBUILD", "versions": [{"status": "affected", "version": "4.4.0"}, {"status": "affected", "version": "4.4.1"}, {"status": "affected", "version": "4.4.2"}, {"status": "affected", "version": "4.4.3"}, {"status": "affected", "version": "4.4.4"}, {"status": "affected", "version": "4.4.5"}, {"status": "affected", "version": "4.4.6"}, {"status": "affected", "version": "4.4.7"}, {"status": "affected", "version": "4.4.8"}, {"status": "affected", "version": "4.4.9"}, {"status": "affected", "version": "4.4.10"}, {"status": "affected", "version": "4.4.11"}]}], "timeline": [{"lang": "en", "time": "2026-09-28T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-28T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-28T21:09:47.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/411151", "name": "VDB-411151 | REBUILD file-editor-save authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/411151/cti", "name": "VDB-411151 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-102249", "name": "CVE-2026-102249 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/933733", "name": "Submit #933733 | REBUILD 4.4.7-release Improper Authorization", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ASantsSec/CVE/issues/26", "tags": ["exploit", "issue-tracking"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-29T03:45:12.603Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102249", "state": "PUBLISHED", "dateUpdated": "2026-10-01T15:42:12.308Z", "dateReserved": "2026-09-28T19:04:36.570Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-29T03:45:12.603Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:rebuild:rebuild:*:*:*:*:*:*:*:*"], "product": "REBUILD", "vendor": "n/a", "versions": [{"status": "affected", "version": "4.4.0"}, {"status": "affected", "version": "4.4.1"}, {"status": "affected", "version": "4.4.2"}, {"status": "affected", "version": "4.4.3"}, {"status": "affected", "version": "4.4.4"}, {"status": "affected", "version": "4.4.5"}, {"status": "affected", "version": "4.4.6"}, {"status": "affected", "version": "4.4.7"}, {"status": "affected", "version": "4.4.8"}, {"status": "affected", "version": "4.4.9"}, {"status": "affected", "version": "4.4.10"}, {"status": "affected", "version": "4.4.11"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "id": "CVE-2026-102249", "lastModified": "2026-10-01T16:17:34.067", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102249", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-01T15:41:46.473837Z", "version": "2.0.3"}}]}, "published": "2026-09-29T04:17:54.917", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/ASantsSec/CVE/issues/26"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-102249"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/933733"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/411151"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/411151/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}, {"lang": "en", "value": "CWE-863"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "REBUILD", "source": "cna", "vendor": "n/a"}, "product": "rebuild", "vendor": "rebuild"}], "created": "2026-09-29T05:30:12.624207+00:00", "updated": "2026-09-29T05:45:12.620538+00:00", "vendors": ["rebuild", "rebuild$PRODUCT$rebuild"]}