CVE-2026-26053

An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-26053	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre::::::::

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de asignación de privilegios incorrecta (CWE-266) en el Servidor Command Centre permite a un operador autenticado con privilegios limitados realizar algunas operaciones para las que normalmente no estaría autorizado. Versión de Command Centre afectada: 9.50 anterior a vEL9.50.1587(MR1), 9.40 anterior a vEL9.40.3130(MR3), 9.30 anterior a vEL9.30.3983(MR5), 9.20 anterior a vEL9.20.4349(MR7), todas las versiones de 9.10.

Information

Published : 2026-07-07 05:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-26053

Mitre link : CVE-2026-26053

CVE.ORG link : CVE-2026-26053

JSON object : View

Products Affected

gallagher

command_centre

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2026-26053", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26053", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T13:37:41.225293Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosures@gallagher.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "disclosures@gallagher.com", "affectedData": [{"vendor": "Gallagher", "product": "Command Centre Server", "versions": [{"status": "affected", "version": "9.10", "versionType": "custom"}, {"status": "affected", "version": "9.50", "lessThan": "vEL9.50.1587(MR1)", "versionType": "custom"}, {"status": "affected", "version": "9.40", "lessThan": "vEL9.40.3130(MR3)", "versionType": "custom"}, {"status": "affected", "version": "9.30", "lessThan": "vEL9.30.3983(MR5)", "versionType": "custom"}, {"status": "affected", "version": "9.20", "lessThan": "vEL9.20.4349(MR7)", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-07T05:16:50.117", "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-26053", "tags": ["Vendor Advisory"], "source": "disclosures@gallagher.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosures@gallagher.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "An\u00a0Incorrect Privilege Assignment (CWE-266)\u00a0vulnerability in\u00a0the Command Centre Server\u00a0allows an\u00a0authenticated operator with limited privileges\u00a0to perform some operations that they would not normally be authorized to perform.\u00a0Version of Command Centre affected:\u00a09.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10."}, {"lang": "es", "value": "Una vulnerabilidad de asignaci\u00f3n de privilegios incorrecta (CWE-266) en el Servidor Command Centre permite a un operador autenticado con privilegios limitados realizar algunas operaciones para las que normalmente no estar\u00eda autorizado. Versi\u00f3n de Command Centre afectada: 9.50 anterior a vEL9.50.1587(MR1), 9.40 anterior a vEL9.40.3130(MR3), 9.30 anterior a vEL9.30.3983(MR5), 9.20 anterior a vEL9.20.4349(MR7), todas las versiones de 9.10."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB625DB4-746E-43B1-BAC9-EE3629BD361D", "versionEndExcluding": "9.20.4349"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9BFCEF8-9768-4049-B6AE-146EB73510B1", "versionEndExcluding": "9.30.3983", "versionStartIncluding": "9.30.1594"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DF03990-81B3-4F40-98C8-3245AAA95BF8", "versionEndExcluding": "9.40.3130", "versionStartIncluding": "9.40.1359"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83B80C58-A4DC-4901-B877-A20A65177DE7", "versionEndExcluding": "9.50.1587", "versionStartIncluding": "9.50.978"}], "operator": "OR"}]}], "sourceIdentifier": "disclosures@gallagher.com"}