Dashboard / CVE-2026-65938

CVE-2026-65938

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 54/100
Published: 2026-08-12 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: Low
A: None

Description

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
progress whatsup_gold < 26.0.2

References & Advisories (3)

Bug Bounty Relevance

54 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

4.3 / 10.0 v3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploitation Probability

0.25%
Raw Score 0.002530
Percentile 16.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00253
2026-10-28
0.00253

Intelligence Sources

nvd ref →

External Links