CVE-2026-119682: Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus
An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ManageEngine SharePoint Manager Plusto a version that resolves this vulnerability.Fixed in 4507
Event History
Frequently Asked Questions
Which deployments are affected?
The issue was reproduced in ManageEngine SharePoint Manager Plus build 4506 and fixed in build 4507. The provided information does not identify other affected builds.
What access does an attacker need to exploit this?
An attacker needs a low-privileged authenticated account. No user interaction is required, and the issue can be exploited over the network.
What can an attacker do after exploiting the issue?
They can read and modify MFA configuration, enable or disable MFA, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Invalid MFA configuration can weaken authentication controls or lock legitimate users out of the application.
How can organizations tell whether they are exposed?
Check the installed SharePoint Manager Plus build. Build 4506 is explicitly identified as vulnerable, while build 4507 contains the fix.