CVE-2026-86804: seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization
A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. Upgrading to version 1.11.11 is able to resolve this issue. The identifier of the patch is 842eec791377ddcbea5cd639bc065eaa4801d656. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
seakee CPA-Manager-Plus HTTP Handler (CPAResource in apps/manager-server/internal/http/controller/proxy/handler.go)to a version that resolves this vulnerability.Fixed in 1.11.11Patch 842eec791377ddcbea5cd639bc065eaa4801d656
Event History
Frequently Asked Questions
Which deployments are affected?
seakee CPA-Manager-Plus versions up to and including 1.11.10 are affected. Version 1.11.11 resolves the issue.
Can this be exploited remotely without prior access?
Yes. The vulnerability is remotely exploitable, and the supplied vector indicates no privileges or user interaction are required.
What component should be prioritized for remediation?
Prioritize the HTTP Handler's CPAResource function in apps/manager-server/internal/http/controller/proxy/handler.go. Upgrade the affected component to version 1.11.11; the referenced patch identifier is 842eec791377ddcbea5cd639bc065eaa4801d656.