CVE-2026-19441: Unauthenticated API Allows Analytics Data Manipulation in IKAS Technology's Rush

Q: Who can exploit this issue?

The vulnerability has network attack vector, requires no privileges, and requires no user interaction. An unauthenticated remote attacker can target the affected API functionality.

Q: What is the potential impact?

The documented impact is integrity-only: an attacker can manipulate analytics data by faking its source. No confidentiality or availability impact is indicated by the supplied severity vector.

Q: Which Rush versions are affected?

Rush is affected through version 21082026. No fixed version is provided in the available data.

Published Aug 21, 2026

Updated

Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data.

This issue affects Rush: through 21082026.

Affected Software

1 affected component

IKAS Technology Inc. Rush<=21082026

Event History

Aug 21, 2026

CVE Published

via MITRE·07:55 AM

Data Sourced

via MITRE·07:55 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability has network attack vector, requires no privileges, and requires no user interaction. An unauthenticated remote attacker can target the affected API functionality.

What is the potential impact?

The documented impact is integrity-only: an attacker can manipulate analytics data by faking its source. No confidentiality or availability impact is indicated by the supplied severity vector.

Which Rush versions are affected?