CVE-2026-12593

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12593", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "TQtC", "dateReserved": "2026-06-18T09:26:17.599Z", "datePublished": "2026-07-09T12:29:47.260Z", "dateUpdated": "2026-07-09T14:20:19.757Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "TQtC", "dateUpdated": "2026-07-09T12:29:47.260Z"}, "title": "Privilege escalation via forged API token creation in Axivion Dashboard OIDC/OAuth2/SSO subsystem", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Authenticated Remote Privilege escalation. Any OIDC/OAuth authenticated user can become a Dashboard Administrator. By exploiting another weakness this can also lead to arbitrary code execution on the host-system running the Dashboard in the context of the OS-User used to run the Dashboard."}]}], "affected": [{"vendor": "Qt", "product": "Axivion", "modules": ["Dashboard OIDC/OAuth2/SSO subsystem"], "versions": [{"status": "affected", "version": "7.8.5", "lessThanOrEqual": "7.8.12", "versionType": "custom"}, {"status": "affected", "version": "7.9.0", "lessThan": "7.9.13", "versionType": "custom"}, {"status": "affected", "version": "7.10.0", "lessThan": "7.10.11", "versionType": "custom"}, {"status": "affected", "version": "7.11.0", "lessThan": "7.11.7", "versionType": "custom"}, {"status": "affected", "version": "7.12.0", "lessThan": "7.12.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:qt:axivion:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.8.5", "versionEndIncluding": "7.8.12"}, {"vulnerable": true, "criteria": "cpe:2.3:a:qt:axivion:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.9.0", "versionEndExcluding": "7.9.13"}, {"vulnerable": true, "criteria": "cpe:2.3:a:qt:axivion:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.10.0", "versionEndExcluding": "7.10.11"}, {"vulnerable": true, "criteria": "cpe:2.3:a:qt:axivion:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.11.0", "versionEndExcluding": "7.11.7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:qt:axivion:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.12.0", "versionEndExcluding": "7.12.2"}]}]}], "descriptions": [{"lang": "en", "value": "The implementation of an internal\u00a0and\u00a0undocumented\u00a0Dashboard\u00a0API endpoint\u00a0(POST /api/users/~/{user}/tokens)\u00a0forgot\u00a0to ensure an HTTP\u00a0request for creating an\u00a0API\u00a0Token for another\u00a0user had sufficient permission to do so.\n\n\n\n\n\nPrecondition for successful exploitation was a preexisting internal user (with more privileges than the attacker),\u00a0the attacker knowing\u00a0its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker\u00a0would then have\u00a0had\u00a0to forge a token creation\u00a0API\u00a0request\u00a0on behalf of the\u00a0other user and could have authenticated\u00a0and\u00a0finalized\u00a0the token creation\u00a0with their own\u00a0OAuth/OIDC\u00a0credentials. In the worst case, this would mean an attacker could\u00a0have\u00a0become Dashboard Administrator\u00a0and\u00a0been\u00a0able to\u00a0perform\u00a0all\u00a0administrative actions\u00a0if the preexisting internal user had administrative\u00a0privileges.\u00a0In combination with a separate weakness,\u00a0this could have\u00a0further\u00a0led\u00a0to code execution on the\u00a0host\u00a0system running the Dashboard with the privileges of the OS-User running the Dashboard\u00a0server.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><p>The implementation of an internal&nbsp;and&nbsp;undocumented&nbsp;Dashboard&nbsp;API endpoint&nbsp;(POST /api/users/~/{user}/tokens)&nbsp;forgot&nbsp;to ensure an HTTP&nbsp;request for creating an&nbsp;API&nbsp;Token for another&nbsp;user had sufficient permission to do so.</p></div><div><p>Precondition for successful exploitation was a preexisting internal user (with more privileges than the attacker),&nbsp;the attacker knowing&nbsp;its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker&nbsp;would then have&nbsp;had&nbsp;to forge a token creation&nbsp;API&nbsp;request&nbsp;on behalf of the&nbsp;other user and could have authenticated&nbsp;and&nbsp;finalized&nbsp;the token creation&nbsp;with their own&nbsp;OAuth/OIDC&nbsp;credentials. In the worst case, this would mean an attacker could&nbsp;have&nbsp;become Dashboard Administrator&nbsp;and&nbsp;been&nbsp;able to&nbsp;perform&nbsp;all&nbsp;administrative actions&nbsp;if the preexisting internal user had administrative&nbsp;privileges.&nbsp;In combination with a separate weakness,&nbsp;this could have&nbsp;further&nbsp;led&nbsp;to code execution on the&nbsp;host&nbsp;system running the Dashboard with the privileges of the OS-User running the Dashboard&nbsp;server.</p></div>"}]}], "references": [{"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-12593", "name": "Qt Group Internal Vulnerability Ticket", "tags": ["issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"}}], "workarounds": [{"lang": "en", "value": "Disable the OIDC/OAuth2/SSO authentication feature or shut down the Dashboard server.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Disable the OIDC/OAuth2/SSO authentication feature or shut down the Dashboard server.</p>"}]}], "solutions": [{"lang": "en", "value": "Update to one of the fixed releases: 7.9.13, 7.10.11, 7.11.7, or 7.12.2. There is no fixed release on the 7.8.x branch; deployments running 7.8.5-7.8.12 must migrate to one of the fixed releases.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Update to one of the fixed releases: 7.9.13, 7.10.11, 7.11.7, or 7.12.2. There is no fixed release on the 7.8.x branch; deployments running 7.8.5-7.8.12 must migrate to one of the fixed releases.</p>"}]}], "source": {"discovery": "INTERNAL", "defectId": "BAUHAUS-30026"}, "x_generator": {"engine": "Claude AI (Opus 4.8) - draft only, requires human validation before submission"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T14:20:08.451329Z", "id": "CVE-2026-12593", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T14:20:19.757Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12593", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-09T14:20:08.451329Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T14:20:15.130Z"}}], "cna": {"title": "Privilege escalation via forged API token creation in Axivion Dashboard OIDC/OAuth2/SSO subsystem", "source": {"defectId": "BAUHAUS-30026", "discovery": "INTERNAL"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Authenticated Remote Privilege escalation. Any OIDC/OAuth authenticated user can become a Dashboard Administrator. By exploiting another weakness this can also lead to arbitrary code execution on the host-system running the Dashboard in the context of the OS-User used to run the Dashboard."}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Qt", "modules": ["Dashboard OIDC/OAuth2/SSO subsystem"], "product": "Axivion", "versions": [{"status": "affected", "version": "7.8.5", "versionType": "custom", "lessThanOrEqual": "7.8.12"}, {"status": "affected", "version": "7.9.0", "lessThan": "7.9.13", "versionType": "custom"}, {"status": "affected", "version": "7.10.0", "lessThan": "7.10.11", "versionType": "custom"}, {"status": "affected", "version": "7.11.0", "lessThan": "7.11.7", "versionType": "custom"}, {"status": "affected", "version": "7.12.0", "lessThan": "7.12.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to one of the fixed releases: 7.9.13, 7.10.11, 7.11.7, or 7.12.2. There is no fixed release on the 7.8.x branch; deployments running 7.8.5-7.8.12 must migrate to one of the fixed releases.", "supportingMedia": [{"type": "text/html", "value": "<p>Update to one of the fixed releases: 7.9.13, 7.10.11, 7.11.7, or 7.12.2. There is no fixed release on the 7.8.x branch; deployments running 7.8.5-7.8.12 must migrate to one of the fixed releases.</p>", "base64": false}]}], "references": [{"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-12593", "name": "Qt Group Internal Vulnerability Ticket", "tags": ["issue-tracking"]}], "workarounds": [{"lang": "en", "value": "Disable the OIDC/OAuth2/SSO authentication feature or shut down the Dashboard server.", "supportingMedia": [{"type": "text/html", "value": "<p>Disable the OIDC/OAuth2/SSO authentication feature or shut down the Dashboard server.</p>", "base64": false}]}], "x_generator": {"engine": "Claude AI (Opus 4.8) - draft only, requires human validation before submission"}, "descriptions": [{"lang": "en", "value": "The implementation of an internal\u00a0and\u00a0undocumented\u00a0Dashboard\u00a0API endpoint\u00a0(POST /api/users/~/{user}/tokens)\u00a0forgot\u00a0to ensure an HTTP\u00a0request for creating an\u00a0API\u00a0Token for another\u00a0user had sufficient permission to do so.\n\n\n\n\n\nPrecondition for successful exploitation was a preexisting internal user (with more privileges than the attacker),\u00a0the attacker knowing\u00a0its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker\u00a0would then have\u00a0had\u00a0to forge a token creation\u00a0API\u00a0request\u00a0on behalf of the\u00a0other user and could have authenticated\u00a0and\u00a0finalized\u00a0the token creation\u00a0with their own\u00a0OAuth/OIDC\u00a0credentials. In the worst case, this would mean an attacker could\u00a0have\u00a0become Dashboard Administrator\u00a0and\u00a0been\u00a0able to\u00a0perform\u00a0all\u00a0administrative actions\u00a0if the preexisting internal user had administrative\u00a0privileges.\u00a0In combination with a separate weakness,\u00a0this could have\u00a0further\u00a0led\u00a0to code execution on the\u00a0host\u00a0system running the Dashboard with the privileges of the OS-User running the Dashboard\u00a0server.", "supportingMedia": [{"type": "text/html", "value": "<div><p>The implementation of an internal&nbsp;and&nbsp;undocumented&nbsp;Dashboard&nbsp;API endpoint&nbsp;(POST /api/users/~/{user}/tokens)&nbsp;forgot&nbsp;to ensure an HTTP&nbsp;request for creating an&nbsp;API&nbsp;Token for another&nbsp;user had sufficient permission to do so.</p></div><div><p>Precondition for successful exploitation was a preexisting internal user (with more privileges than the attacker),&nbsp;the attacker knowing&nbsp;its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker&nbsp;would then have&nbsp;had&nbsp;to forge a token creation&nbsp;API&nbsp;request&nbsp;on behalf of the&nbsp;other user and could have authenticated&nbsp;and&nbsp;finalized&nbsp;the token creation&nbsp;with their own&nbsp;OAuth/OIDC&nbsp;credentials. In the worst case, this would mean an attacker could&nbsp;have&nbsp;become Dashboard Administrator&nbsp;and&nbsp;been&nbsp;able to&nbsp;perform&nbsp;all&nbsp;administrative actions&nbsp;if the preexisting internal user had administrative&nbsp;privileges.&nbsp;In combination with a separate weakness,&nbsp;this could have&nbsp;further&nbsp;led&nbsp;to code execution on the&nbsp;host&nbsp;system running the Dashboard with the privileges of the OS-User running the Dashboard&nbsp;server.</p></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qt:axivion:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "7.8.12", "versionStartIncluding": "7.8.5"}, {"criteria": "cpe:2.3:a:qt:axivion:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.9.13", "versionStartIncluding": "7.9.0"}, {"criteria": "cpe:2.3:a:qt:axivion:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.10.11", "versionStartIncluding": "7.10.0"}, {"criteria": "cpe:2.3:a:qt:axivion:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.11.7", "versionStartIncluding": "7.11.0"}, {"criteria": "cpe:2.3:a:qt:axivion:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.12.2", "versionStartIncluding": "7.12.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "TQtC", "dateUpdated": "2026-07-09T12:29:47.260Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12593", "state": "PUBLISHED", "dateUpdated": "2026-07-09T14:20:19.757Z", "dateReserved": "2026-06-18T09:26:17.599Z", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "datePublished": "2026-07-09T12:29:47.260Z", "assignerShortName": "TQtC"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Dashboard OIDC/OAuth2/SSO subsystem"], "product": "Axivion", "vendor": "Qt", "versions": [{"lessThanOrEqual": "7.8.12", "status": "affected", "version": "7.8.5", "versionType": "custom"}, {"lessThan": "7.9.13", "status": "affected", "version": "7.9.0", "versionType": "custom"}, {"lessThan": "7.10.11", "status": "affected", "version": "7.10.0", "versionType": "custom"}, {"lessThan": "7.11.7", "status": "affected", "version": "7.11.0", "versionType": "custom"}, {"lessThan": "7.12.2", "status": "affected", "version": "7.12.0", "versionType": "custom"}]}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The implementation of an internal\u00a0and\u00a0undocumented\u00a0Dashboard\u00a0API endpoint\u00a0(POST /api/users/~/{user}/tokens)\u00a0forgot\u00a0to ensure an HTTP\u00a0request for creating an\u00a0API\u00a0Token for another\u00a0user had sufficient permission to do so.\n\n\n\n\n\nPrecondition for successful exploitation was a preexisting internal user (with more privileges than the attacker),\u00a0the attacker knowing\u00a0its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker\u00a0would then have\u00a0had\u00a0to forge a token creation\u00a0API\u00a0request\u00a0on behalf of the\u00a0other user and could have authenticated\u00a0and\u00a0finalized\u00a0the token creation\u00a0with their own\u00a0OAuth/OIDC\u00a0credentials. In the worst case, this would mean an attacker could\u00a0have\u00a0become Dashboard Administrator\u00a0and\u00a0been\u00a0able to\u00a0perform\u00a0all\u00a0administrative actions\u00a0if the preexisting internal user had administrative\u00a0privileges.\u00a0In combination with a separate weakness,\u00a0this could have\u00a0further\u00a0led\u00a0to code execution on the\u00a0host\u00a0system running the Dashboard with the privileges of the OS-User running the Dashboard\u00a0server."}, {"lang": "es", "value": "La implementaci\u00f3n de un endpoint de API de Dashboard interno y no documentado (POST /api/users/~/{user}/tokens) olvid\u00f3 asegurar que una solicitud HTTP para crear un token de API para otro usuario tuviera permisos suficientes para hacerlo.\n\nLa condici\u00f3n previa para una explotaci\u00f3n exitosa era un usuario interno preexistente (con m\u00e1s privilegios que el atacante), que el atacante conociera su nombre de inicio de sesi\u00f3n y que el atacante pudiera autenticarse en el Dashboard a trav\u00e9s de OAuth/OIDC. El atacante entonces habr\u00eda tenido que falsificar una solicitud de API de creaci\u00f3n de token en nombre del otro usuario y podr\u00eda haberse autenticado y finalizado la creaci\u00f3n del token con sus propias credenciales de OAuth/OIDC. En el peor de los casos, esto significar\u00eda que un atacante podr\u00eda haberse convertido en Administrador del Dashboard y haber podido realizar todas las acciones administrativas si el usuario interno preexistente ten\u00eda privilegios administrativos. En combinaci\u00f3n con una debilidad separada, esto podr\u00eda haber llevado adem\u00e1s a la ejecuci\u00f3n de c\u00f3digo en el sistema host que ejecuta el Dashboard con los privilegios del usuario del sistema operativo (OS-User) que ejecuta el servidor del Dashboard."}], "id": "CVE-2026-12593", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12593", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T14:20:08.451329Z", "version": "2.0.3"}}]}, "published": "2026-07-09T14:16:26.713", "references": [{"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-12593"}], "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.8.5,7.8.12]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.9.0,7.9.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.10.0,7.10.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.11.0,7.11.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.12.0,7.12.2)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Axivion", "source": "cna", "vendor": "Qt"}, "product": "axivion", "vendor": "qt"}], "created": "2026-07-09T16:15:16.540910+00:00", "updated": "2026-08-01T14:45:06.529291+00:00", "vendors": ["qt", "qt$PRODUCT$axivion"]}