Dashboard / CVE-2026-121146

CVE-2026-121146

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 39/100
Published: 2026-11-04 Modified: 2026-11-05 First seen: 2026-11-04 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: None
VA: None

Description

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session tokens. Successful exploitation of this vulnerability could allow the attacker to impersonate the associated user and gain unauthorized access to vehicle related information and services.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
Tata Motors Tata Motors iRA 2.0 versions 26.7.3 and below
Tata Motors Tata Motors iRA 2.0 versions 26.7.3 and below
Tata Motors Tata Motors iRA.ev versions 26.7.2 and below
Tata Motors Tata Motors iRA.ev versions 26.7.2 and below

References & Advisories (1)

Bug Bounty Relevance

39 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

6.8 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.12%
Raw Score 0.001190
Percentile 1.8%
Date 2026-11-05

Intelligence Sources

mitre ref →
nvd ref →

External Links