CVE-2026-102298: Insufficient Authorization and User Boundary Validation in Omada Controller MSP
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication.
Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using TP-Link Omada Controller in MSP mode are exposed. The issue is in the user-confirmation endpoint used in that mode.
What does an attacker need to exploit it?
An attacker needs to be authenticated and able to send requests to the user-confirmation endpoint. They can control the Identifier parameter to target another account.
What can exploitation reveal or enable?
Endpoint responses distinguish nonexistent users, invalid passwords, and successful authentication, enabling user enumeration and credential verification. Successful exploitation may also permit unauthorized access to MSP resources or compromise targeted accounts.