CVE-2026-110669: Missing Authentication in cemtan sar2html

The vulnerability CVE-2026-110669 in cemtan sar2html 4.0.0 involves missing authentication checks in the deleteHost, deleteRange, and deleteAll functions within the sar2html.py file. This allows remote attackers to invoke these functions without proper authorization, potentially leading to unauthorized deletion of data or hosts. The issue was reported early to the project but remains unaddressed. The CVSS 4.0 base score is 6.9, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality and availability.

Remote attackers can exploit the missing authentication to perform unauthorized deletions via the affected functions. This could disrupt normal operations by deleting hosts or ranges without permission. The impact is rated medium due to the ability to perform these actions remotely without authentication, but with limited impact on confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should consider restricting network access to the affected functions or disabling the vulnerable features until a patch is available.