CVE-2026-107795: CWE-862 Missing Authorization in TP-Link Systems Inc. Omada Software Controller
Description
CVE-2026-107795 is a vulnerability in TP-Link Systems Inc.'s Omada Software Controller affecting versions prior to 6.3.0.45. The issue involves missing authorization checks in the MSP and OpenAPI certificate/private-key management APIs. This flaw allows an authenticated user with low privileges to perform privileged operations such as uploading or deleting TLS certificates or private keys. Exploitation could disrupt secure management access to the controller. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVSS v4.0
Score 7.5high
Affected software
TP-Link Systems Inc.
Omada Software Controller
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Omada Software Controller's MSP and OpenAPI APIs for certificate and private-key management do not properly enforce administrative authorization. As a result, an authenticated user with lower privileges than intended can perform privileged certificate management operations, including uploading or deleting TLS certificates or private keys. This could lead to disruption of secure management access to the controller. The vulnerability affects versions from 0 up to but not including 6.3.0.45.
Potential Impact
An attacker with authenticated access but low privileges can manipulate the controller's TLS certificates or private keys. This could disrupt secure management access, potentially causing denial of secure administrative control over the Omada Software Controller.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to authenticated users and monitor for unauthorized certificate management activities.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TPLink
- Date Reserved
- 2026-10-08T21:19:52.178Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad006d62cdf04f656b77f72
Added to database: 10/14/2026, 22:48:54 UTC
Last enriched: 10/14/2026, 23:03:20 UTC
Last updated: 10/15/2026, 00:48:09 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.