PT-2026-35812 · O2Oa · O2Oa

Larlarua · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7292

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions o2oa versions prior to 10.0

Description An improper authorization issue exists in the NodeAgent component within the syncFile() function of the NodeAgent.java file. This flaw allows a remote attacker to initiate an attack, although the complexity is high and exploitability is considered difficult.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the syncFile() function within the NodeAgent component to minimize the risk of exploitation.

Exploit

Incorrect Privilege Assignment

Improper Authorization

Weakness Enumeration

CWE-266

CWE-285

Related Identifiers

CVE-2026-7292

Affected Products

O2Oa

References · 7

• 🔥 https://github.com/o2oa/o2oa/issues/194 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7292 · Security Note
• https://github.com/o2oa/o2oa · Note
• https://vuldb.com/vuln/359952/cti · Note
• https://vuldb.com/submit/803074 · Note
• https://twitter.com/CVEnew/status/2049227558441361475 · Twitter Post
• https://vuldb.com/vuln/359952 · Note