CVE-2026-11889 is a vulnerability in SALTO ProAccess Space related to improper access control in the tenancy or logical partition feature. An authorized attacker with some level of access can escalate privileges to access any space managed by the product, violating intended access restrictions. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no vendor advisory or patch information available at this time.

An authorized attacker can bypass tenancy restrictions to access any space managed by SALTO ProAccess Space, potentially leading to unauthorized modification or control of resources within those spaces. Confidentiality and availability are not impacted according to the CVSS vector. The integrity impact is high, meaning data or configurations could be altered without authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authorized users only and monitor for unusual privilege escalations. No official fix or temporary workaround has been published by the vendor.