PT-2026-8251 · Unknown · Enet Smart Home Server

Gjoko Krstic · Published 2026-02-15 · Updated 2026-02-15 · CVE-2026-26367

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions eNet SMART HOME server versions 2.2.1 through 2.3.1

Description The eNet SMART HOME server software has a flaw where authorization checks are absent in the deleteUserAccount JSON-RPC method. This allows a standard, authenticated user (UG USER) to remove other user accounts, with the exception of the built-in admin account. The application fails to implement role-based access control for this function. An attacker can send a specially crafted POST request to the /jsonrpc/management API endpoint, specifying a username to be deleted, without needing higher privileges or further confirmation. The vulnerable parameter is username.

Recommendations eNet SMART HOME server version 2.2.1: Implement proper role-based access control for the deleteUserAccount function. eNet SMART HOME server version 2.3.1: Implement proper role-based access control for the deleteUserAccount function.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-26367

Affected Products

Enet Smart Home Server

References · 8

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2026-5973.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26367 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26367 · Vendor Advisory
• https://t.me/CVEtracker/44773 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2023075614035476849 · Twitter Post
• https://t.me/cveNotify/152067 · Telegram Post
• https://vulncheck.com/advisories/jung-enet-smart-home-server-arbitrary-user-deletio · Note
• https://twitter.com/CVEnew/status/2023062013685944639 · Twitter Post