PT-2026-56795 · Qt · Axivion

Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-12593

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An internal and undocumented Dashboard API endpoint POST /api/users/~/{user}/tokens fails to verify if a request to create an API token for another user has the necessary permissions. An attacker authenticated via OAuth/OIDC who knows the login name of a more privileged internal user can forge a token creation request. This allows the attacker to authenticate as that user, potentially gaining Dashboard Administrator privileges and performing all administrative actions. When combined with another weakness, this could lead to code execution on the host system with the privileges of the OS-User running the Dashboard server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-12593

Affected Products

Axivion

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-12593 · Security Note
• https://twitter.com/infoflowcloud/status/2075230097989042272 · Twitter Post
• https://twitter.com/CVEnew/status/2075229342515204424 · Twitter Post
• https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-12593 · Note