{"id":"CVE-2026-89309","title":"The authorization middleware of the WMS MobileServer\nfails to require authentication in two distinct cases","summary":"The authorization middleware of the WMS MobileServer\nfails to require authentication in two distinct cases. First, it\nonly requires an Authorization header for GET and HEAD requests; requests\nusing any other HTTP method are processed wit…","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-306"],"vendor":"JTL SW GmbH","product":"JTL-WMS","affected":["JTL-WMS < 2.0.7","JTL-WMS < 2.1.2","JTL-WMS < 2.2.1","JTL-WMS 1.7.*, 1.8.*, 1.9.*, 1.10.*, 1.11.*"],"published":"2026-10-13","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:04:29.760","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89309","references":[{"url":"https://www.jtl-software.com/de/cve-2026-89309-cve-2026-89310","label":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"},{"url":"https://www.enisa.europa.eu","label":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"tags":["nvd","cve.org"],"epss":0.00389,"epssPercentile":0.32799,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T17:03:43.189746Z"},"ingestedAt":"2026-10-13T09:20:23.197Z","slug":"CVE-2026-89309","body":"## Overview\n\nThe authorization middleware of the WMS MobileServer\nfails to require authentication in two distinct cases. First, it\nonly requires an Authorization header for GET and HEAD requests; requests\nusing any other HTTP method are processed without an authentication check.\nSecond, for any HTTP method including GET and HEAD, a request carrying a\nmalformed or non-bearer Authorization header is passed through without\na valid token being required.\n\n\n\n\n\nThe middleware does validate a token whenever a\nwell-formed one is present, but in these two cases it does not\nrequire one. A remote attacker with network access to the service can\ntherefore invoke API functionality without valid credentials.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":219971,"id":"CVE-2026-89309","ts":1791962530342,"field":"cvss","old":null,"new":"10"},{"seq":219970,"id":"CVE-2026-89309","ts":1791962530342,"field":"severity","old":"none","new":"critical"}]}