This vulnerability (CVE-2026-42098) involves the use of client-side authentication in Sparx Systems Enterprise Architect, which is intended to restrict user actions based on assigned roles. However, an authenticated attacker can modify the client behavior, such as by using a debugger, to bypass these restrictions and log in as any other user or administrator. This leads to full unauthorized access to modify the repository. The issue was confirmed in version 17.1 and earlier; other versions have not been tested. No official remediation or patch has been provided by the vendor as of the publication date.

An attacker with valid authentication can escalate privileges by impersonating any user or administrator, enabling unauthorized changes to the repository. This compromises the integrity and potentially the confidentiality of the data managed by Enterprise Architect. The vulnerability does not require user interaction beyond authentication and has a high CVSS 4.0 score of 8.7, indicating significant impact on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation has been published by Sparx Systems, users should exercise caution with client access and consider restricting authenticated user privileges until a patch or official guidance is available.