CVE-2026-81758: CWE-862 Missing Authorization in OwnerRez OwnerRez API

This vulnerability, identified as CVE-2026-81758, affects OwnerRez API versions up to 1.2.6. It is classified as CWE-862, indicating missing authorization controls that lead to broken access control. The flaw allows users with some privileges to potentially access or manipulate resources without proper authorization. The CVSS v3.1 base score is 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time, and the vulnerability is not related to a cloud service. No active exploitation has been observed.

An attacker with limited privileges could exploit this missing authorization vulnerability to gain unauthorized access or perform unauthorized actions within the OwnerRez API, potentially leading to partial compromise of confidentiality, integrity, and availability of the system or data. The impact is considered medium severity based on the CVSS score and described effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor for updates from OwnerRez and apply any recommended temporary mitigations if provided. Avoid granting unnecessary privileges to users to reduce risk exposure.