CVE-2026-103903: CWE-863 Incorrect Authorization in MikroTik RouterOS

This vulnerability arises from improper authorization checks in the WinBox authentication process of MikroTik RouterOS. The authentication involves a two-stage EC-SRP challenge: the first stage verifies the attacker's low-privilege account, while the second stage accepts an independently supplied username to assign privileges. By specifying a higher-privilege username in the second stage, the attacker can obtain the authorization policy of that account and establish a full administrative session without the target account's password. This flaw enables privilege escalation from a low-privilege authenticated user to full administrative control.

An attacker with valid low-privilege credentials can escalate their privileges to full administrative rights on the affected MikroTik RouterOS device. This can lead to complete control over the device, including configuration changes and privilege modifications, potentially compromising network security and device integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict WinBox access to trusted users and networks to minimize exposure. Monitor for vendor updates regarding patches or official mitigations.