Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

JTL-WMS allows unauthenticated API access

CVE-2026-89309 · published 1 day ago
Summary

The JTL-WMS mobile server does not always check that a user is logged in before processing requests. An attacker on the same network could call the system’s functions without a valid password or token. Apply the vendor’s update or restrict network access to the service until it is patched.

What to do
  • Update tbc tbc to version 1 or later.
  • Update jtl sw gmbh jtl-wms to version 2.0.7 or later.
Affected software
VendorProductAffected versions
tbc tbc < 1
jtl sw gmbh jtl-wms < 2.0.7
Original advisory text
Missing Authentication Vulnerability in JTL-WMS
The authorization middleware of the WMS MobileServer
fails to require authentication in two distinct cases. First, it
only requires an Authorization header for GET and HEAD requests; requests
using any other HTTP method are processed without an authentication check.
Second, for any HTTP method including GET and HEAD, a request carrying a
malformed or non-bearer Authorization header is passed through without
a valid token being required.





The middleware does validate a token whenever a
well-formed one is present, but in these two cases it does not
require one. A remote attacker with network access to the service can
therefore invoke API functionality without valid credentials.
References
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published13 Oct 2026
Updated14 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-89309 · NVD
CVE-2026-89309 · MITRE
Track software like this
Free during beta