CVE-2026-112197
Missing Authentication for Critical Function in Tactis' NoviGest Desktop App
CRITICAL 9.4
En bref
- Source
- CVE.org
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- INCIBE
Description
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.
Faiblesses (CWE)
- CWE-306 — Authentification absente sur une fonction critique
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | CRITICAL 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | INCIBE |
Références européennes
- ENISA EUVD · EUVD-2026-111991
- GCVE · GCVE-0-2026-112197
Produits affectés
| Produit | Versions |
|---|---|
| Tactis · NoviGest Desktop App | affected NoviGest Desktop App prior to version 8.0.0-300 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |