CVE-2026-84860

ScadaLTS 2.8.1-release-candidate build 0 enforces Spring Security access control on DWR endpoints only by URL path pattern, while DWR actually decides which Java method to invoke from POST body parameters (c0-scriptName and c0-methodName). Because the crossDomainSessionSecurity setting in web.xml is set to false, DWR's built-in origin validation is disabled, so any authenticated user can send a request to a URL they are permitted to access (such as MiscDwr.initializeLongPoll.dwr) while naming a restricted class in the POST body. This lets a low-privilege authenticated user invoke any DWR method that should be off-limits, effectively bypassing URL-based authorization and enabling several other ScadaLTS flaws to be exploited without elevated privileges. Any deployment of ScadaLTS 2.8.1-release-candidate build 0 with authenticated low-privilege accounts is affected. No public proof-of-concept or known exploitation has been reported, and the issue is not in CISA's KEV catalog.

What to do: Upgrade ScadaLTS to a release that fixes the DWR authorization bypass as soon as the vendor publishes one (no fixed version is stated in the available data). As an interim mitigation, set crossDomainSessionSecurity to true in web.xml to restore DWR origin validation, restrict network access to the ScadaLTS web interface, and limit which low-privilege accounts exist on internet-reachable instances. Because this bypass chains with other DWR-based findings, review access logs for authenticated low-privilege users calling restricted DWR classes.