Vulnerability record/PUBLISHED/Published Nov 11, 2026 17:32:36 UTC
CVE-2026-106133
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.
Base score6.3/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactLowA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityProgressSoftware
Last updatedNov 11, 2026 17:32:36 UTC
PublishedNov 11, 2026 17:32:36 UTC
ReservedOct 6, 2026 15:51:08 UTC
Credits
- Noam Frenkel