---
cve: "CVE-2026-89293"
severity: "HIGH"
cvss: 8.8
epss: "0.5%"
vendor: "Eclipse Foundation"
kev: false
exploited: false
published: "2026-11-03 09:38:23"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-08T17:31:03+01:00"
---

# CVE-2026-89293

> 8.8 HIGH

## Beschreibung

In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.

## CNA-Record (Kanon, cvelistV5)

- CNA: **eclipse**
- State: PUBLISHED
- Stand: 2026-11-03 20:21:20
- CNA-CVSS: **8.8** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-602** — Client-Side Enforcement of Server-Side Security
  The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server.
- **CWE-862** — Missing Authorization
  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

## Angriffsmuster (CAPEC)

- [CAPEC-21 — Exploitation of Trusted Identifiers](https://capec.mitre.org/data/definitions/21.html) _(Severity: High)_
- [CAPEC-31 — Accessing/Intercepting/Modifying HTTP Cookies](https://capec.mitre.org/data/definitions/31.html) _(Severity: High)_
- [CAPEC-162 — Manipulating Hidden Fields](https://capec.mitre.org/data/definitions/162.html) _(Severity: High)_
- [CAPEC-202 — Create Malicious Client](https://capec.mitre.org/data/definitions/202.html) _(Severity: Medium)_
- [CAPEC-207 — Removing Important Client Functionality](https://capec.mitre.org/data/definitions/207.html) _(Severity: High)_
- [CAPEC-208 — Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrements](https://capec.mitre.org/data/definitions/208.html) _(Severity: Medium)_
- [CAPEC-383 — Harvesting Information via API Event Monitoring](https://capec.mitre.org/data/definitions/383.html) _(Severity: Low)_
- [CAPEC-384 — Application API Message Manipulation via Man-in-the-Middle](https://capec.mitre.org/data/definitions/384.html) _(Severity: Low)_

## ATT&CK-Techniken

- [T1134 — Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)
- [T1528 — Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [T1539 — Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)
- [T1056.004 — Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/)

## Referenzen

- <https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/772>
- <https://gitlab.eclipse.org/security/cve-assignment/-/work_items/301>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-89293/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_