CVE-2026-15541

A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

CVSS v3 7.3 HIGH
CVSS v2.0 7.5 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/will-moss/isaiah/
https://github.com/will-moss/isaiah/issues/34
https://github.com/will-moss/isaiah/pull/35
https://vuldb.com/cve/CVE-2026-15541
https://vuldb.com/submit/855074
https://vuldb.com/vuln/377891
https://vuldb.com/vuln/377891/cti

Configurations

No configuration.

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Se ha encontrado una vulnerabilidad en will-moss Isaiah hasta 1.36.9. El elemento afectado es la función Server.Handle del archivo app/server/server/server.go del componente Gestor Maestro de Websockets. La ejecución de una manipulación del argumento Agent puede llevar a una falta de autorización. Es posible lanzar el ataque de forma remota. La pull request para solucionar este problema espera ser aceptada.

Information

Published : 2026-07-13 08:16

Updated : 2026-10-24 22:10

NVD link : CVE-2026-15541

Mitre link : CVE-2026-15541

CVE.ORG link : CVE-2026-15541

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

CWE-863

Incorrect Authorization

{"id": "CVE-2026-15541", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15541", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T14:28:18.172388Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:will-moss:isaiah:*:*:*:*:*:*:*:*"], "vendor": "will-moss", "modules": ["Master Websocket Handler"], "product": "Isaiah", "versions": [{"status": "affected", "version": "1.36.0"}, {"status": "affected", "version": "1.36.1"}, {"status": "affected", "version": "1.36.2"}, {"status": "affected", "version": "1.36.3"}, {"status": "affected", "version": "1.36.4"}, {"status": "affected", "version": "1.36.5"}, {"status": "affected", "version": "1.36.6"}, {"status": "affected", "version": "1.36.7"}, {"status": "affected", "version": "1.36.8"}, {"status": "affected", "version": "1.36.9"}]}]}], "published": "2026-07-13T08:16:20.600", "references": [{"url": "https://github.com/will-moss/isaiah/", "source": "cna@vuldb.com"}, {"url": "https://github.com/will-moss/isaiah/issues/34", "source": "cna@vuldb.com"}, {"url": "https://github.com/will-moss/isaiah/pull/35", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-15541", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/855074", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/377891", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/377891/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-862"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en will-moss Isaiah hasta 1.36.9. El elemento afectado es la funci\u00f3n Server.Handle del archivo app/server/server/server.go del componente Gestor Maestro de Websockets. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento Agent puede llevar a una falta de autorizaci\u00f3n. Es posible lanzar el ataque de forma remota. La pull request para solucionar este problema espera ser aceptada."}], "lastModified": "2026-10-24T22:10:00.210", "sourceIdentifier": "cna@vuldb.com"}