CVE-2026-108070: CWE-552 Files or directories accessible to external parties in TSplus TSplus Remote Access

This vulnerability (CWE-552) in TSplus Remote Access 19.20.3.10 allows an unauthenticated remote attacker to bypass access controls by manipulating paths in requests to the /socket.io/JWN/ endpoint. This improper access control flaw enables access to internal resources that should be protected, potentially exposing sensitive data or functionality. The CVSS 4.0 score is 8.7 (high), reflecting the network attack vector, no privileges or user interaction required, and high impact on confidentiality.

An unauthenticated remote attacker can access internal resources that are intended to be protected, potentially leading to unauthorized disclosure of sensitive information or unauthorized interaction with internal components of the TSplus Remote Access system. The vulnerability does not require privileges or user interaction, increasing its risk.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the TSplus Remote Access web server to trusted networks and monitor for suspicious access attempts targeting the /socket.io/JWN/ endpoint.