CVE-2026-89309

Summary

The WMS MobileServer's authorization middleware fails to require authentication for non-GET/HEAD requests and malformed Authorization headers, allowing unauthenticated API access. This creates a critical authorization bypass that enables remote attackers to invoke protected functionality without valid credentials.

Exploitability

Exploitation is trivial with network access to the service, requiring no special prerequisites beyond basic connectivity to the affected API endpoints.

Blast radius

The impact could be severe across all API functionality exposed by the MobileServer, potentially allowing full system compromise through unauthorized access to sensitive operations and data.

Detection

Monitor for API requests with missing Authorization headers or malformed Bearer tokens in application logs, particularly for non-GET/HEAD methods, and look for unusual patterns of authenticated vs unauthenticated access attempts.

Prioritized remediation

Upgrade to version 2.590 or later to receive the patched authorization middleware that properly validates authentication for all HTTP methods and handles malformed Authorization headers correctly.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.