CVE-2026-106133

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106133", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-10-06T15:51:08.623Z", "datePublished": "2026-11-11T17:32:36.189Z", "dateUpdated": "2026-11-11T17:32:36.189Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-11-11T17:32:36.189Z"}, "title": "Incorrect Authorization in Telerik Report Server Web Report Designer", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "Progress Software", "product": "Telerik Report Server", "versions": [{"status": "affected", "version": "0", "lessThan": "12.3.26.1110", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Progress\u00ae Telerik\u00ae Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.</p>"}]}], "references": [{"url": "https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-authorization-cve-2026-106133", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}}], "credits": [{"lang": "en", "value": "Noam Frenkel", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Telerik Report Server", "vendor": "Progress Software", "versions": [{"lessThan": "12.3.26.1110", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "security@progress.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Telerik\u00ae Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability."}], "id": "CVE-2026-106133", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "security@progress.com", "type": "Secondary"}]}, "published": "2026-11-11T18:18:24.023", "references": [{"source": "security@progress.com", "url": "https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-authorization-cve-2026-106133"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@progress.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,12.3.26.1110)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Telerik Report Server", "source": "cna", "vendor": "Progress Software"}, "product": "telerik_report_server", "vendor": "progress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,12.3.26.1110)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Telerik Report Server", "source": "cna", "vendor": "Progress Software"}, "product": "telerik_report_server", "vendor": "progress_software"}], "created": "2026-11-12T07:30:22.073150+00:00", "updated": "2026-11-13T01:30:09.448011+00:00", "vendors": ["progress", "progress$PRODUCT$telerik_report_server", "progress_software", "progress_software$PRODUCT$telerik_report_server"]}