CVE-2026-40463: Vulnerability in Nokia WaveSuite

CVE-2026-40463 describes a vulnerability in Nokia WaveSuite where the CPB Log Files feature does not enforce sufficient role-based access control. Authenticated users with low privileges can bypass intended access restrictions by directly requesting URLs of pages reserved for higher-privilege roles. This vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 7.6, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. The affected versions are specifically 23.6, 24.6, 24.12, and 25.6. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated low-privilege user to access sensitive pages and data restricted to higher-privilege roles, leading to a high confidentiality impact. Integrity and availability impacts are low but present. This could result in unauthorized information disclosure within the affected Nokia WaveSuite deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected versions and monitor for suspicious activity related to unauthorized access attempts. Avoid granting unnecessary privileges to users and consider additional access control measures where possible.