CVE-2026-90448

CVE-2026-90448 is a missing-authorization flaw (CWE-862) in a deployment mode of an application that is intended to expose stored data for reading only. In that mode, the application proxies a set of backend API routes without filtering which HTTP request methods are permitted, so a route that creates or overwrites a stored record — accepting an attacker-chosen identifier — remains reachable, and the backend executes the write using the application's own elevated credentials. An authenticated, low-privileged user with network access to a read-only deployment can therefore forge new records or silently overwrite records that should be immutable, producing a high integrity impact with no confidentiality loss (CVSS 4.0: 7.1, PR:L/VI:H). The CVE was assigned by CISA ICS-CERT, indicating the affected software is likely an industrial/OT product, but the vendor, product name, and version ranges are not stated in the available data. No public proof-of-concept is known and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation has not been confirmed.

What to do: Monitor the CISA ICS-CERT advisory and the vendor's release notes for the fixed version and upgrade as soon as it is published. As an interim mitigation, restrict the read-only deployment at a fronting reverse proxy or WAF to read-only HTTP methods (e.g., GET/HEAD only), limit network access to the deployment to trusted users, and audit stored records and request logs for unexpected writes or attacker-chosen identifiers from low-privileged accounts.