CVE-2026-94410: Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service
Published Oct 13, 2026
·Updated
A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.
Affected Software
1 affected component
Bender Custom&Partner Service
Event History
Oct 13, 2026
CVE Published
via MITRE·11:37 AM
Data Sourced
via MITRE·11:37 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker with low-privileged access can exploit it. No user interaction is required.
2
What information can be exposed?
The issue exposes a list of roles that should be restricted to administrators. The reported impact is limited to low-level confidentiality exposure, with no integrity or availability impact.
3
Is an unauthenticated attacker affected by this issue?
The provided vector indicates privileges are required (PR:L), so the issue is not described as exploitable by an unauthenticated attacker.