Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Malcolm read‑only mode lets users change stored records

CVE-2026-90448 · published 1 month ago
Summary

The Malcolm application can be set to a mode that should only allow viewing data, but it still lets users send requests that create or overwrite records. An attacker who is logged in can modify data that was meant to be read‑only, using the system's own high‑level credentials. Change the configuration to block write requests in read‑only mode or apply the latest update that fixes this behavior.

What to do
  • Update cisa malcolm to version v26.06.0 or later.
Affected software
VendorProductAffected versions
cisa malcolm < v26.06.0
Original advisory text
Missing Authorization in Malcolm
A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application's own elevated backend credentials. This allows an authenticated user on a deployment intended to be read-only to forge or overwrite stored records that should not be modifiable in that deployment mode.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published11 Sep 2026
Updated3 Nov 2026
First seen11 Sep 2026
Sources
CVE-2026-90448 · NVD
CVE-2026-90448 · MITRE
CVE-2026-90448 · OSV
Track software like this
Free during beta