PT-2026-31704 · Unknown · Openplc V3

Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-35063

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenPLC V3 (affected versions not specified)

Description The OpenPLC V3 REST API endpoint does not verify the caller's role after confirming the presence of a JWT. An authenticated user with the 'user' role can delete any user, including administrators, by providing the target user's ID. Additionally, users can create new accounts with the 'admin' role, leading to full administrator access. The API endpoint in question does not properly enforce authorization checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-35063

Affected Products

Openplc V3

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-35063 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-345-10 · Note
• https://twitter.com/CVEnew/status/2042340073463497074 · Twitter Post