CVE-2026-28808

critical

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via s…

Vendor / product: Erlang — erlang\/inets

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

CVSS

9.8

9.8 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-04-07 13:16

Modified: 2026-10-26 22:10

NVD status: Modified

Last synced 2 days ago

Verified against the source API 2026-10-27 07:07 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

erlang / erlang\/inets ≥5.10 <9.1.0.6, >9.2 <9.3.2.4, >9.4 <9.6.2

erlang / erlang\/otp ≥17.0 <26.2.5.19, ≥27.0 <27.3.4.10, ≥28.0 <28.4.2

Weakness classification (CWE)

CWE-863 CWE-551

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://cna.erlef.org/cves/CVE-2026-28808.html

Patch / mitigation: https://cna.erlef.org/cves/CVE-2026-28808.html

Patch / mitigation: https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688

Patch / mitigation: https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c

Patch / mitigation: https://osv.dev/vulnerability/EEF-CVE-2026-28808

References

https://cna.erlef.org/cves/CVE-2026-28808.html 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
https://osv.dev/vulnerability/EEF-CVE-2026-28808 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
https://www.erlang.org/doc/system/versions.html#order-of-versions 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
https://access.redhat.com/security/cve/CVE-2026-28808 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://bugzilla.redhat.com/show_bug.cgi?id=2455909 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28808.json 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores