CVE-2026-42160

Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered "PENDING" organization / user accounts. This issue has been patched in version 7.3.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/sovity/dataspace-portal/releases/tag/v7.3.2
https://github.com/sovity/dataspace-portal/security/advisories/GHSA-989g-wpfv-6vxx
https://github.com/sovity/dataspace-portal/security/advisories/GHSA-989g-wpfv-6vxx

Configurations

No configuration.

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Data Space Portal es una solución de Software como Servicio (SaaS) de código abierto diseñada para optimizar la gestión de Espacios de Datos. Desde la versión 2.1.1 hasta antes de la versión 7.3.2, existe una autorización insuficiente en el backend de dataspace-portal con respecto a las cuentas de organización / usuario autorregistradas ’PENDIENTE’. Este problema ha sido parcheado en la versión 7.3.2.

Information

Published : 2026-05-08 20:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42160

Mitre link : CVE-2026-42160

CVE.ORG link : CVE-2026-42160

JSON object : View

Products Affected

No product.

CWE

CWE-602

Client-Side Enforcement of Server-Side Security

CWE-863

Incorrect Authorization

{"id": "CVE-2026-42160", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42160", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-11T18:18:00.481315Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sovity", "product": "dataspace-portal", "versions": [{"status": "affected", "version": ">= 2.1.1, < 7.3.2"}]}]}], "published": "2026-05-08T20:16:30.743", "references": [{"url": "https://github.com/sovity/dataspace-portal/releases/tag/v7.3.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/sovity/dataspace-portal/security/advisories/GHSA-989g-wpfv-6vxx", "source": "security-advisories@github.com"}, {"url": "https://github.com/sovity/dataspace-portal/security/advisories/GHSA-989g-wpfv-6vxx", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-602"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered \"PENDING\" organization / user accounts. This issue has been patched in version 7.3.2."}, {"lang": "es", "value": "Data Space Portal es una soluci\u00f3n de Software como Servicio (SaaS) de c\u00f3digo abierto dise\u00f1ada para optimizar la gesti\u00f3n de Espacios de Datos. Desde la versi\u00f3n 2.1.1 hasta antes de la versi\u00f3n 7.3.2, existe una autorizaci\u00f3n insuficiente en el backend de dataspace-portal con respecto a las cuentas de organizaci\u00f3n / usuario autorregistradas \u2019PENDIENTE\u2019. Este problema ha sido parcheado en la versi\u00f3n 7.3.2."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "security-advisories@github.com"}