CVE-2026-64948 - Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure

Back Back to CVE browser

HIGH

Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure

Published Oct 1, 2026

7.1

HIGH

CVSS 4.0

EPSS 0.21%

Description

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.

Affected products

Vendor Pandora FMS Product Pandora FMS Default
unaffected
- Version
  777
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pandora FMS

unaffected

Version	Status	Constraints
777	affected	-

Remediation

Vendor solution

Fixed v800.5 and v804

Weaknesses (1)

CWE-639

Authorization Bypass

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90597		Advisory
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner PandoraFMS

Published Oct 1, 2026

Updated Oct 1, 2026

Reserved Jul 21, 2026

Link CVE-2026-64948

CISA Vulnrichment

Updated Oct 1, 2026

NVD

Status Received

Modified Oct 1, 2026

Link CVE-2026-64948

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-64948

ENISA EUVD

Assigner PandoraFMS

Published Oct 1, 2026

Updated Oct 1, 2026

Exploited since n/a

Link EUVD-2026-90597

EUVD-2026-90597