CVE-2026-74994: CWE-863 Incorrect Authorization in Erlang OTP

The mod_auth module in Erlang OTP's inets httpd server improperly collapses multiple directory configuration blocks into a single shared user/group namespace when using dets or mnesia authentication backends. This results in incorrect authorization where a user added to one protected directory is erroneously accepted as valid for all other protected directories on the same server instance. The issue affects OTP versions from 17.0 up to but not including 27.3.4.17, 28.0 up to but not including 28.5.0.6, and 29.0 up to but not including 29.0.6. Corresponding affected inets versions are from 5.10 up to but not including 9.3.2.7, 9.4 up to but not including 9.6.2.3, and 9.7 up to but not including 9.7.2. It is unknown if versions before OTP 17.0 / inets 5.10 are affected.

This vulnerability allows a user authorized for one protected directory to gain unauthorized access to other protected directories on the same server instance due to shared user/group namespaces. This could lead to unauthorized access to restricted resources within the inets httpd server environment. The CVSS 4.0 score is 6.0 (medium severity), reflecting network attack vector, low attack complexity, partial privileges required, and high impact on confidentiality.

A fix is available in OTP versions 27.3.4.17 and later, 28.5.0.6 and later, and 29.0.6 and later, as well as corresponding fixed inets versions 9.3.2.7 and later, 9.6.2.3 and later, and 9.7.2 and later. Users should upgrade to these fixed versions to remediate the vulnerability. No vendor advisory content was provided to indicate otherwise, so patching is recommended.