CVE-2026-42096: Broken Access Control in Sparx Pro Cloud Server
Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42096?
CVE-2026-42096 has a severity rating of high, with a CVSS score of 8.7.
How do I fix CVE-2026-42096?
To fix CVE-2026-42096, implement strict permission checks for database access and ensure proper user authorization before executing SQL queries.
What type of vulnerability is CVE-2026-42096?
CVE-2026-42096 is classified as a Broken Access Control vulnerability.
Who is affected by CVE-2026-42096?
Users of Sparx Systems Pro Cloud Server are affected by CVE-2026-42096.
What can attackers do with CVE-2026-42096?
Attackers can exploit CVE-2026-42096 to run arbitrary SQL queries within the database user context without sufficient privileges.