CVE-2026-49192: Summary Service Insecure Direct Object Reference
The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enforce server-side authorization: verify that the authenticated user is the owner of the requested hardware serial number before returning any device data. For requests where ownership cannot be proven, return an appropriate denial (e.g., 403 or 404) and do not include device details.
summary service endpoint ownership_verification = enabled - Compensating control
Until the code fix is deployed, restrict and monitor access to the summary service: require authentication for the endpoint, apply rate-limiting and bot/scraping protections (WAF rules or API gateway throttling), restrict access by IP or network where feasible, and increase logging/alerting to detect bulk scraping attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49192?
CVE-2026-49192 has a medium severity score of 5.3 on the CVSS scale.
How do I fix CVE-2026-49192?
To fix CVE-2026-49192, ensure that the summary service endpoint verifies user ownership of hardware serial numbers correctly.
What is affected by CVE-2026-49192?
CVE-2026-49192 affects the Acer Connect M6e 5g Firmware and exposes device data due to improper access control.
What kind of vulnerability is CVE-2026-49192?
CVE-2026-49192 is classified as an Insecure Direct Object Reference (IDOR) vulnerability.
When was CVE-2026-49192 published?
CVE-2026-49192 was published on June 4, 2026.