CVE-2026-102249: REBUILD file-editor-save authorization
A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
REBUILD installations up to version 4.4.11 are affected. The vulnerable functionality is associated with the /commons/file-editor-save endpoint.
What does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. Exploitation involves manipulating the url or fileKey argument to bypass authorization checks.
How urgent is remediation?
The issue is rated high with a CVSS score of 7.3, and public exploit material is available. The reported impact includes partial compromise of confidentiality, integrity, and availability.
What can be done if an update is not immediately available?
The provided information does not identify a vendor fix or workaround. Restrict remote access to the affected file-editor-save functionality where operationally possible and limit access to trusted users or networks.