CVE-2026-107795: Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations.
Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with low privileges may be able to exploit the affected MSP or OpenAPI certificate/private-key management APIs. The provided information does not indicate that unauthenticated access is sufficient.
What operations could an attacker perform?
A successful attacker may upload or delete the Omada Controller TLS certificate or private key through the affected APIs. This can disrupt secure management access to the controller.
Are deployments affected by default?
The issue applies to the controller's MSP and OpenAPI certificate/private-key management APIs, but the provided information does not state whether these APIs are enabled or reachable in a default deployment.