CVE-2026-14304

In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://eclipse.dev/actf/downloads/tools/miChecker/vulnerability.html	Vendor Advisory
https://github.com/eclipse-actf/org.eclipse.actf	Product
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/151	Vendor Advisory
https://www.soumu.go.jp/info-accessibility-portal/webaccessibility/michecker/	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:eclipse:accessibility_tools_framework::::::::
	cpe:2.3:a:soumu:michecker::::::::

History

No history.

Information

Published : 2026-08-05 11:16

Updated : 2026-08-10 19:01

NVD link : CVE-2026-14304

Mitre link : CVE-2026-14304

CVE.ORG link : CVE-2026-14304

JSON object : View

Products Affected

soumu

michecker

eclipse

accessibility_tools_framework

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2026-14304", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14304", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T13:03:48.752239Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "product": "Eclipse Accessibility Tools Framework (ACTF)", "versions": [{"status": "affected", "version": "0.5.0", "versionType": "semver", "lessThanOrEqual": "1.6.0"}, {"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "v20260630"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T11:16:24.887", "references": [{"url": "https://eclipse.dev/actf/downloads/tools/miChecker/vulnerability.html", "tags": ["Vendor Advisory"], "source": "emo@eclipse.org"}, {"url": "https://github.com/eclipse-actf/org.eclipse.actf", "tags": ["Product"], "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/151", "tags": ["Vendor Advisory"], "source": "emo@eclipse.org"}, {"url": "https://www.soumu.go.jp/info-accessibility-portal/webaccessibility/michecker/", "tags": ["Product"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists.\n\n\n\nIf this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker."}], "lastModified": "2026-08-10T19:01:10.803", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:accessibility_tools_framework:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "300F91D3-CAAE-4D2A-BA7C-D1C3D4CACD2D", "versionEndIncluding": "1.6.0", "versionStartIncluding": "0.5.0"}, {"criteria": "cpe:2.3:a:soumu:michecker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BAF9066-1B9B-4AF8-9196-FB346310AEB4", "versionEndExcluding": "3.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}