CVE-2026-119744

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119744", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T15:31:52.079Z", "datePublished": "2026-11-05T14:50:42.158Z", "dateUpdated": "2026-11-05T16:24:31.150Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T14:50:42.158Z"}, "title": "Cendio ThinLinc Improper Authentication via Web Access", "descriptions": [{"lang": "en", "value": "Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0."}], "datePublic": "2026-04-22T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Authentication Bypass by Spoofing", "cweId": "CWE-290", "type": "CWE"}]}], "affected": [{"defaultStatus": "unaffected", "vendor": "Cendio", "product": "ThinLinc", "versions": [{"status": "affected", "version": "4.1.0", "versionType": "semver", "lessThan": "4.15.1"}, {"status": "affected", "version": "4.16.0", "versionType": "semver", "lessThan": "4.16.1"}, {"status": "affected", "version": "4.17.0", "versionType": "semver", "lessThan": "4.17.1"}, {"status": "affected", "version": "4.18.0", "versionType": "semver", "lessThan": "4.18.1"}, {"status": "affected", "version": "4.19.0", "versionType": "semver", "lessThan": "4.19.1"}, {"status": "affected", "version": "4.20.0", "versionType": "semver", "lessThan": "4.20.1"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "references": [{"url": "https://community.thinlinc.com/t/thinlinc-4-15-1-through-4-20-1-security-release/1985", "name": "ThinLinc 4.15.1 through 4.20.1 security release", "tags": ["release-notes", "patch"]}, {"url": "https://community.thinlinc.com/t/urgent-thinlinc-security-issue/1970", "name": "Urgent: ThinLinc security issue", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/cendio-thinlinc-improper-authentication-via-web-access", "name": "VulnCheck Advisory: Cendio ThinLinc Improper Authentication via Web Access", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Cosmikal S.L.", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T16:24:14.643454Z", "id": "CVE-2026-119744", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:24:31.150Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119744", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T16:24:14.643454Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:24:05.476Z"}}], "cna": {"title": "Cendio ThinLinc Improper Authentication via Web Access", "credits": [{"lang": "en", "type": "finder", "value": "Cosmikal S.L."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Cendio", "product": "ThinLinc", "versions": [{"status": "affected", "version": "4.1.0", "lessThan": "4.15.1", "versionType": "semver"}, {"status": "affected", "version": "4.16.0", "lessThan": "4.16.1", "versionType": "semver"}, {"status": "affected", "version": "4.17.0", "lessThan": "4.17.1", "versionType": "semver"}, {"status": "affected", "version": "4.18.0", "lessThan": "4.18.1", "versionType": "semver"}, {"status": "affected", "version": "4.19.0", "lessThan": "4.19.1", "versionType": "semver"}, {"status": "affected", "version": "4.20.0", "lessThan": "4.20.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T00:00:00.000Z", "references": [{"url": "https://community.thinlinc.com/t/thinlinc-4-15-1-through-4-20-1-security-release/1985", "name": "ThinLinc 4.15.1 through 4.20.1 security release", "tags": ["release-notes", "patch"]}, {"url": "https://community.thinlinc.com/t/urgent-thinlinc-security-issue/1970", "name": "Urgent: ThinLinc security issue", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/cendio-thinlinc-improper-authentication-via-web-access", "name": "VulnCheck Advisory: Cendio ThinLinc Improper Authentication via Web Access", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T14:50:42.158Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119744", "state": "PUBLISHED", "dateUpdated": "2026-11-05T16:24:31.150Z", "dateReserved": "2026-10-30T15:31:52.079Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-05T14:50:42.158Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ThinLinc", "vendor": "Cendio", "versions": [{"lessThan": "4.15.1", "status": "affected", "version": "4.1.0", "versionType": "semver"}, {"lessThan": "4.16.1", "status": "affected", "version": "4.16.0", "versionType": "semver"}, {"lessThan": "4.17.1", "status": "affected", "version": "4.17.0", "versionType": "semver"}, {"lessThan": "4.18.1", "status": "affected", "version": "4.18.0", "versionType": "semver"}, {"lessThan": "4.19.1", "status": "affected", "version": "4.19.0", "versionType": "semver"}, {"lessThan": "4.20.1", "status": "affected", "version": "4.20.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0."}], "id": "CVE-2026-119744", "lastModified": "2026-11-12T21:30:23.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119744", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T16:24:14.643454Z", "version": "2.0.3"}}]}, "published": "2026-11-05T15:17:20.557", "references": [{"source": "disclosure@vulncheck.com", "url": "https://community.thinlinc.com/t/thinlinc-4-15-1-through-4-20-1-security-release/1985"}, {"source": "disclosure@vulncheck.com", "url": "https://community.thinlinc.com/t/urgent-thinlinc-security-issue/1970"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/cendio-thinlinc-improper-authentication-via-web-access"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "thinlinc: ThinLinc: Privilege escalation via multi-step authentication bypass", "id": "2567473", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567473"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-841", "details": ["A flaw was found in ThinLinc. The browser-based web client fails to properly validate authentication state during multi-step login procedures, such as one-time password prompts or login notices. An authenticated attacker can exploit this flaw to bypass authentication controls and impersonate any user, allowing them to gain unauthorized administrative access to the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-119744", "public_date": "2026-11-05T14:50:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119744\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119744\nhttps://community.thinlinc.com/t/thinlinc-4-15-1-through-4-20-1-security-release/1985\nhttps://community.thinlinc.com/t/urgent-thinlinc-security-issue/1970\nhttps://www.vulncheck.com/advisories/cendio-thinlinc-improper-authentication-via-web-access"], "statement": "This vulnerability is rated as having Important severity because a low-privileged authenticated attacker can hijack arbitrary active sessions and gain root-level administrative access, resulting in a severe compromise of host confidentiality and integrity. The risk is constrained to Important rather than Critical because successful exploitation requires valid existing credentials to initiate the session, preventing unauthenticated remote execution. Additionally, ThinLinc is a third-party remote desktop solution that is not shipped or supported in Red Hat Enterprise Linux or other Red Hat products.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,4.15.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.16.0,4.16.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.17.0,4.17.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.18.0,4.18.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.19.0,4.19.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.20.0,4.20.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ThinLinc", "source": "cna", "vendor": "Cendio"}, "product": "thinlinc", "vendor": "cendio"}], "created": "2026-11-05T16:45:06.276205+00:00", "updated": "2026-11-06T21:14:27.387026+00:00", "vendors": ["cendio", "cendio$PRODUCT$thinlinc"]}