CVE-2026-26367

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26367", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-15T15:02:17.449Z", "datePublished": "2026-02-15T15:29:54.646Z", "dateUpdated": "2026-03-02T14:49:41.144Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-02T14:49:41.144Z"}, "datePublic": "2026-02-14T00:00:00.000Z", "title": "JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccount", "descriptions": [{"lang": "en", "value": "eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permissions or additional confirmation."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "affected": [{"vendor": "JUNG", "product": "eNet SMART HOME server", "versions": [{"version": "2.3.1 (46841)", "status": "affected"}, {"version": "2.2.1 (46056)", "status": "affected"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5973.php", "name": "ZeroScience Vulnerability Advisory ZSL-2026-5973", "tags": ["third-party-advisory"]}, {"name": "VulnCheck Advisory: JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccount", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/jung-enet-smart-home-server-arbitrary-user-deletio"}], "credits": [{"lang": "en", "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T16:50:44.981581Z", "id": "CVE-2026-26367", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:50:52.127Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26367", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T16:50:44.981581Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:42:14.046Z"}}], "cna": {"title": "JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccount", "credits": [{"lang": "en", "type": "finder", "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "JUNG", "product": "eNet SMART HOME server", "versions": [{"status": "affected", "version": "2.3.1 (46841)"}, {"status": "affected", "version": "2.2.1 (46056)"}]}], "datePublic": "2026-02-14T00:00:00.000Z", "references": [{"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5973.php", "name": "ZeroScience Vulnerability Advisory ZSL-2026-5973", "tags": ["third-party-advisory"]}, {"url": "https://www.vulncheck.com/advisories/jung-enet-smart-home-server-arbitrary-user-deletio", "name": "VulnCheck Advisory: JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccount", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permissions or additional confirmation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-02T14:49:41.144Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26367", "state": "PUBLISHED", "dateUpdated": "2026-03-02T14:49:41.144Z", "dateReserved": "2026-02-15T15:02:17.449Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-15T15:29:54.646Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "eNet SMART HOME server", "vendor": "JUNG", "versions": [{"status": "affected", "version": "2.3.1 (46841)"}, {"status": "affected", "version": "2.2.1 (46056)"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jung-group:enet_smart_home:2.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "4B230A5E-D3D3-4F14-8F2C-6230798C0A61", "vulnerable": true}, {"criteria": "cpe:2.3:a:jung-group:enet_smart_home:2.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "B80A70BE-E277-40FC-9E03-C5D31F9DAD5B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permissions or additional confirmation."}, {"lang": "es", "value": "eNet SMART HOME server 2.2.1 y 2.3.1 contiene una vulnerabilidad de autorizaci\u00f3n faltante en el m\u00e9todo JSON-RPC deleteUserAccount que permite a cualquier usuario autenticado con privilegios bajos (UG_USER) eliminar cuentas de usuario arbitrarias, excepto la cuenta de administrador integrada. La aplicaci\u00f3n no aplica control de acceso basado en roles en esta funci\u00f3n, permitiendo a un usuario est\u00e1ndar enviar una solicitud POST manipulada a /jsonrpc/management especificando otro nombre de usuario para que esa cuenta sea eliminada sin permisos elevados ni confirmaci\u00f3n adicional."}], "id": "CVE-2026-26367", "lastModified": "2026-06-17T10:26:09.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26367", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T16:50:44.981581Z", "version": "2.0.3"}}]}, "published": "2026-02-15T16:15:54.060", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Broken Link"], "url": "https://www.vulncheck.com/advisories/jung-enet-smart-home-server-arbitrary-user-deletio"}, {"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5973.php"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.3.1 (46841)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.2.1 (46056)"}}], "product": "enet_smart_home_server", "vendor": "jung"}], "analysis": {"en": {"generated_at": "2026-04-16T17:09:02.404533+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011supplied patch or upgrade to a version of eNet SMART HOME server that does not contain the vulnerable deleteUserAccount method.", "Ensure that only users with administrative roles are allowed to invoke deleteUserAccount; verify role\u2011based access control settings and adjust if necessary.", "Secure the JSON\u2011RPC endpoint by restricting access to trusted IP ranges or by placing it behind a firewall and enabling strong authentication mechanisms."], "summary": {"action": "Immediate Patch", "impact": "User Account Deletion / Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The issue affects JUNG eNet SMART HOME server versions 2.2.1 and 2.3.1. The built\u2011in admin account is protected, but all other user accounts are susceptible to deletion.", "description_and_impact": "The vulnerability stems from a missing authorization check in the deleteUserAccount JSON\u2011RPC method. An authenticated low\u2011privileged user can craft a POST request to /jsonrpc/management and specify any other username, causing that account to be removed without the usual administrative confirmation. This flaw targets confidence in the integrity of user accounts and can lead to denial of service for legitimate users. It is classified as CWE\u2011862, a lack of proper role\u2011based access control.", "risk_and_exploitability": "With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score of < 1% indicates a currently low exploitation probability; however, the vulnerability remains significant because it is accessible over the network to any authenticated user. KEV does not list this entry, but the exposed endpoint and the credential\u2011based nature of the attack make it a candidate for opportunistic exploitation. The likely attack vector is remote via the JSON\u2011RPC interface, assuming the attacker has a valid user credential that does not have administrative privileges."}}}}, "created": "2026-02-16T09:42:48.287930+00:00", "updated": "2026-04-16T17:15:17.989634+00:00", "vendors": ["jung", "jung$PRODUCT$enet_smart_home_server"], "weaknesses": ["CWE-862"]}