---
id: CVE-2026-86934
title: >-
  An authorization bypass vulnerability in the FileMaker Server Web Publishing
  Engine allowed requests containing an extended privilege header to bypass the
  disabled Custom Web Publishing with XML setting and access the XML Web
  Publishing …
summary: >-
  An authorization bypass vulnerability in the FileMaker Server Web Publishing
  Engine allowed requests containing an extended privilege header to bypass the
  disabled Custom Web Publishing with XML setting and access the XML Web
  Publishing …
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-639
vendor: claris
product: filemaker_server
affected:
  - filemaker_server < 26.0.3
patched:
  - filemaker_server 26.0.3
published: '2026-09-23'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T18:17:38.370'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86934'
references:
  - url: 'https://support.claris.com/s/answerview?anum=000049217&language=en_US'
    label: product-security@apple.com
tags:
  - nvd
  - cve.org
epss: 0.00315
epssPercentile: 0.24304
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-24T14:39:23.364539Z'
ingestedAt: '2026-09-23T17:28:14.860Z'
---

## Overview

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.

## Affected

- `filemaker_server < 26.0.3`

## Remediation

Upgrade past the affected range:

- `filemaker_server 26.0.3`