CVEvulnerability

CVE-2026-2254

6.3 MEDIUM Published 2026-05-27 Modified 2026-07-24 Official page ↗
Status
Analyzed
Published
2026-05-27
Last modified
2026-07-24
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-732

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoints related to platform mail notfications.

Affected configurations

• hitachi vantara pentaho data integration and analytics (< 10.2.0.7) • hitachi vantara pentaho data integration and analytics (> 10.2.0.8 < 11.0.0.0) • hitachi vantara pentaho data integration and analytics 8.3 • hitachi vantara pentaho data integration and analytics 9.3

Related

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References