{"id":"CVE-2026-86934","published":"2026-09-23T18:17:09.847","lastModified":"2026-09-24T15:17:49.783","description":"An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://support.claris.com/s/answerview?anum=000049217&language=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows unauthorized access to the XML Web Publishing interface by bypassing the Custom Web Publishing with XML setting through an extended privilege header, posing a significant security risk.","exploitability":"Exploitation requires sending a request with a specific extended privilege header, which is moderately difficult and requires knowledge of the header format.","blast_radius":"If exploited, this could lead to unauthorized access to sensitive XML Web Publishing data, compromising the integrity and confidentiality of the affected system.","remediation":"Upgrade to FileMaker Server version 26.0.3 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","xml","filemaker"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-28T08:52:15.675Z"}}