CVE-2026-107187: Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to unauthenticated database reads?
Instances where the authentication bypass can be chained with the vulnerable workflow rule are exposed to database reads without authentication. The issue can disclose sensitive database details, including usernames and passwords.
What does an attacker need to exploit this issue?
The attacker needs to send a DWR request specifying the affected workflow rule. Unauthenticated exploitation additionally depends on chaining the authentication bypass vulnerability described in the advisory.
Are database changes confirmed?
No. Database write and delete operations may be possible, but they were not tested.