Incorrect Authorization in CODESYS Control
Published May 26, 2026
7.2
HIGHCVSS 4.0
EPSS 0.45%
Description
The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges.
Affected products
-
Affected
- ≥ 3.0.0.0, < 3.5.22.20
-
Affected
- ≥ 3.0.0.0, < 3.5.22.20
-
Affected
- ≥ 3.0.0.0, < 3.5.22.20
-
Affected
- ≥ 3.0.0.0, < 4.21.0.0
-
Affected
- ≥ 3.0.0.0, < 4.21.0.0
-
Affected
- ≥ 3.0.0.0, < 4.21.0.0
-
Affected
- ≥ 3.0.0.0, < 4.21.0.0
-
Affected
- ≥ 3.0.0.0, < 4.21.0.0
-
Affected
- ≥ 3.0.0.0, < 4.21.0.0
-
Affected
- ≥ 3.0.0.0, < 4.21.0.0
-
Affected
- ≥ 3.0.0.0, < 4.21.0.0
-
Affected
- ≥ 3.0.0.0, < 4.21.0.0
-
Affected
- ≥ 3.0.0.0, < 4.21.0.0
-
Affected
- ≥ 3.0.0.0, < 3.5.22.20
-
Affected
- ≥ 3.0.0.0, < 3.5.22.20
-
Affected
- ≥ 3.0.0.0, < 4.21.0.0
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Codesys | CODESYS Control RTE (SL) | unaffected | Affected
|
| Codesys | CODESYS Control RTE (for Beckhoff CX) SL | unaffected | Affected
|
| Codesys | CODESYS Control Win (SL) | unaffected | Affected
|
| Codesys | CODESYS Control for BeagleBone SL | unaffected | Affected
|
| Codesys | CODESYS Control for IOT2000 SL | unaffected | Affected
|
| Codesys | CODESYS Control for Linux ARM SL | unaffected | Affected
|
| Codesys | CODESYS Control for Linux SL | unaffected | Affected
|
| Codesys | CODESYS Control for PFC100 SL | unaffected | Affected
|
| Codesys | CODESYS Control for PFC200 SL | unaffected | Affected
|
| Codesys | CODESYS Control for PLCnext SL | unaffected | Affected
|
| Codesys | CODESYS Control for Raspberry Pi SL | unaffected | Affected
|
| Codesys | CODESYS Control for WAGO Touch Panels 600 SL | unaffected | Affected
|
| Codesys | CODESYS Control for emPC-A/iMX6 SL | unaffected | Affected
|
| Codesys | Codesys Hmi (sl) | unaffected | Affected
|
| Codesys | CODESYS Runtime Toolkit | unaffected | Affected
|
| Codesys | CODESYS Virtual Control SL | unaffected | Affected
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (2)
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data