Secuno
ENNL
Book demo

CVE-2026-28808

Erlang Erlang/inets broken access control

9.8 CRITICALEPSS 0.77%
  1. Published7 Apr 2026

Description

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Erlang Erlang/inets≥ 5.10 < 9.1.0.6 · > 9.2 < 9.3.2.4 · > 9.4 < 9.6.2
Erlang Erlang/otp≥ 17.0 < 26.2.5.19 · ≥ 27.0 < 27.3.4.10 · ≥ 28.0 < 28.4.2

Remediation

Fixed in
Erlang Erlang/inets≥ 9.1.0.6
Erlang Erlang/otp≥ 26.2.5.19

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1095598.7
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that…
CVE-2026-773669.9
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian…
CVE-2026-1039038.8
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik…
CVE-2026-1087468.8
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in…
CVE-2026-816499.1
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper…
CVE-2026-1085508.8
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in…

Frequently asked

Is CVE-2026-28808 being actively exploited?

CVE-2026-28808 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.77%.

How severe is CVE-2026-28808?

CVE-2026-28808 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.77% probability of exploitation.

Which products are affected by CVE-2026-28808?

Affected products include Erlang Erlang/inets, Erlang Erlang/otp.

How do I fix CVE-2026-28808?

Upgrade affected software to a fixed version, for example Erlang Erlang/inets 9.1.0.6, Erlang Erlang/otp 26.2.5.19 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-28808 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.