CVE-2026-28808

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-28808
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to inets from 5.10 before 9.6.2, 9.3.2.4 and 9.1.0.6.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cna.erlef.org/cves/CVE-2026-28808.html Mitigation Vendor Advisory
https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688 Patch
https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c Patch
https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f Third Party Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-28808 Patch Third Party Advisory
https://www.erlang.org/doc/system/versions.html#order-of-versions Product
https://access.redhat.com/security/cve/CVE-2026-28808
https://bugzilla.redhat.com/show_bug.cgi?id=2455909
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28808.json
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:erlang:erlang\/inets:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/inets:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/inets:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
History

24 Jul 2026, 15:17

Type Values Removed Values Added
Summary (en) Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to inets from 5.10 until 9.6.2, 9.3.2.4 and 9.1.0.6. (en) Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to inets from 5.10 before 9.6.2, 9.3.2.4 and 9.1.0.6.

30 Jun 2026, 03:18

Type Values Removed Values Added
CWE CWE-551
References
  • () https://access.redhat.com/security/cve/CVE-2026-28808 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2455909 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28808.json -

17 Jun 2026, 10:29

Type Values Removed Values Added
References () https://cna.erlef.org/cves/CVE-2026-28808.html - Vendor Advisory, Mitigation () https://cna.erlef.org/cves/CVE-2026-28808.html - Mitigation, Vendor Advisory
References () https://osv.dev/vulnerability/EEF-CVE-2026-28808 - Third Party Advisory, Patch () https://osv.dev/vulnerability/EEF-CVE-2026-28808 - Patch, Third Party Advisory

23 Apr 2026, 17:39

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References () https://cna.erlef.org/cves/CVE-2026-28808.html - () https://cna.erlef.org/cves/CVE-2026-28808.html - Vendor Advisory, Mitigation
References () https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688 - () https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688 - Patch
References () https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c - () https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c - Patch
References () https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f - () https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f - Third Party Advisory
References () https://osv.dev/vulnerability/EEF-CVE-2026-28808 - () https://osv.dev/vulnerability/EEF-CVE-2026-28808 - Third Party Advisory, Patch
References () https://www.erlang.org/doc/system/versions.html#order-of-versions - () https://www.erlang.org/doc/system/versions.html#order-of-versions - Product
CPE cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/inets:*:*:*:*:*:*:*:*
First Time Erlang erlang\/inets
Erlang
Erlang erlang\/otp

07 Apr 2026, 13:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-07 13:16

Updated : 2026-07-24 15:17

NVD link : CVE-2026-28808

Mitre link : CVE-2026-28808

CVE.ORG link : CVE-2026-28808

JSON object : View

Products Affected

erlang

  • erlang\/inets
  • erlang\/otp
CWE
CWE-863

Incorrect Authorization

CWE-551

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization