ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR… (CVE-2026-84860)
ScadaLTS 2.8.1-release-candidate build 0 contains an authorization bypass vulnerability in its handling of DWR endpoints. The Spring Security framework restricts access based on URL path patterns, but DWR dispatches method calls using POST body parameters, which are not properly validated. The crossDomainSessionSecurity setting is disabled, removing DWR's origin validation. This allows any authenticated user to invoke restricted DWR methods by sending requests to permitted URLs with manipulated POST parameters, enabling privilege escalation and unauthorized actions.
AI Analysis
Technical Summary
ScadaLTS 2.8.1-release-candidate build 0 is vulnerable to an authorization bypass due to a mismatch between Spring Security's URL-based access control and DWR's method dispatch mechanism that relies on POST body parameters (c0-scriptName and c0-methodName). The crossDomainSessionSecurity setting is set to false in web.xml, disabling DWR's origin validation. Consequently, authenticated users can bypass URL-based restrictions by targeting allowed URLs while specifying restricted methods in the POST body, allowing unauthorized invocation of DWR methods. This systemic issue enables exploitation of multiple other vulnerabilities by low privilege users.
Potential Impact
An attacker with valid authentication can bypass authorization controls to invoke any DWR method, including those that should be restricted. This can lead to full confidentiality, integrity, and availability compromise (CVSS 8.8), allowing unauthorized actions that may affect system operation and data security.
Mitigation Recommendations
No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and adjust the crossDomainSessionSecurity setting to enable DWR's origin validation, and consider additional access controls on DWR methods. Restrict authenticated user permissions to minimize potential impact.
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR… (CVE-2026-84860)
Description
ScadaLTS 2.8.1-release-candidate build 0 contains an authorization bypass vulnerability in its handling of DWR endpoints. The Spring Security framework restricts access based on URL path patterns, but DWR dispatches method calls using POST body parameters, which are not properly validated. The crossDomainSessionSecurity setting is disabled, removing DWR's origin validation. This allows any authenticated user to invoke restricted DWR methods by sending requests to permitted URLs with manipulated POST parameters, enabling privilege escalation and unauthorized actions.
CVSS v3.1
Score 8.8high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ScadaLTS 2.8.1-release-candidate build 0 is vulnerable to an authorization bypass due to a mismatch between Spring Security's URL-based access control and DWR's method dispatch mechanism that relies on POST body parameters (c0-scriptName and c0-methodName). The crossDomainSessionSecurity setting is set to false in web.xml, disabling DWR's origin validation. Consequently, authenticated users can bypass URL-based restrictions by targeting allowed URLs while specifying restricted methods in the POST body, allowing unauthorized invocation of DWR methods. This systemic issue enables exploitation of multiple other vulnerabilities by low privilege users.
Potential Impact
An attacker with valid authentication can bypass authorization controls to invoke any DWR method, including those that should be restricted. This can lead to full confidentiality, integrity, and availability compromise (CVSS 8.8), allowing unauthorized actions that may affect system operation and data security.
Mitigation Recommendations
No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and adjust the crossDomainSessionSecurity setting to enable DWR's origin validation, and consider additional access controls on DWR methods. Restrict authenticated user permissions to minimize potential impact.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4vrr-rhf8-cpc9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-84860"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aac8de255bf5e2cf548ff78
Added to database: 09/18/2026, 01:03:30 UTC
Last enriched: 09/18/2026, 01:25:14 UTC
Last updated: 09/18/2026, 01:41:30 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.