CVE-2026-106133: Incorrect Authorization in Telerik Report Server Web Report Designer
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik Report Serverto a version that resolves this vulnerability.Fixed in 12.3.26.1110
Event History
Frequently Asked Questions
Who is exposed to this issue?
Progress Telerik Report Server deployments running a version earlier than 12.3.26.1110 are affected if low-privileged authenticated users can access the Web Report Designer and shared report resources.
What does an attacker need to exploit it?
An attacker needs valid authentication to the affected Report Server and only low privileges. No user interaction is required, and the vulnerability is reachable over the network.
What could an attacker do?
The attacker can perform unauthorized operations on shared report resources, affecting their integrity and availability. The provided information also indicates limited confidentiality impact.
How can I determine whether my deployment is affected?
Check the Telerik Report Server version in use. Versions prior to 12.3.26.1110 are affected.