{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28808",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T13:14:10.515632Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T13:14:16.481Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "affected",
            "packageName": "erlang",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "packageName": "erlang",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "unaffected",
            "packageName": "erlang",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-07T12:28:16.056Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Erlang OTP (inets modules). A remote unauthenticated attacker could exploit an incorrect authorization vulnerability when CGI (Common Gateway Interface) scripts are served via script_alias. This vulnerability arises from a path mismatch where access controls are evaluated against a different path than the script\u0027s execution path. This allows unauthorized access to CGI scripts intended to be protected by directory rules, potentially leading to information disclosure or the execution of unauthorized scripts."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-551",
                "description": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:11:29.745Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-28808"
          },
          {
            "name": "RHBZ#2455909",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455909"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28808.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-07T13:01:42.326Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-07T12:28:16.056Z",
            "value": "Made public."
          }
        ],
        "title": "erlang/otp: inets: Erlang OTP inets modules: Unauthenticated access to protected CGI scripts via incorrect authorization",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "packageName": "otp",
          "packageURL": "pkg:software-id/erlang.org/otp",
          "product": "OTP",
          "programFiles": [
            "lib/inets/src/http_server/mod_alias.erl",
            "lib/inets/src/http_server/mod_auth.erl",
            "lib/inets/src/http_server/mod_cgi.erl"
          ],
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "26.2.5.19",
                  "status": "unaffected"
                },
                {
                  "at": "27.3.4.10",
                  "status": "unaffected"
                },
                {
                  "at": "28.4.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "17.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "packageName": "inets",
          "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "product": "OTP",
          "programFiles": [
            "src/http_server/mod_alias.erl",
            "src/http_server/mod_auth.erl",
            "src/http_server/mod_cgi.erl"
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "9.1.0.6",
                  "status": "unaffected"
                },
                {
                  "at": "9.3.2.4",
                  "status": "unaffected"
                },
                {
                  "at": "9.6.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "5.10",
              "versionType": "otp"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "packageName": "erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "product": "OTP",
          "programFiles": [
            "lib/inets/src/http_server/mod_alias.erl",
            "lib/inets/src/http_server/mod_auth.erl",
            "lib/inets/src/http_server/mod_cgi.erl"
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "8fc71ac6af4fbcc54103bec2983ef22e82942688",
                  "status": "unaffected"
                },
                {
                  "at": "9dfa0c51eac97866078e808dec2183cb7871ff7c",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe inets httpd server must use \u003ccode\u003escript_alias\u003c/code\u003e to map a URL prefix to a CGI directory, combined with \u003ccode\u003edirectory\u003c/code\u003e-based access controls (e.g., \u003ccode\u003emod_auth\u003c/code\u003e) protecting the \u003ccode\u003escript_alias\u003c/code\u003e target path. The vulnerability applies whenever the \u003ccode\u003escript_alias\u003c/code\u003e target path differs from \u003ccode\u003eDocumentRoot\u003c/code\u003e + URL prefix.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The inets httpd server must use `script_alias` to map a URL prefix to a CGI directory, combined with `directory`-based access controls (e.g., `mod_auth`) protecting the `script_alias` target path. The vulnerability applies whenever the `script_alias` target path differs from `DocumentRoot` + URL prefix."
            }
          ],
          "value": "The inets httpd server must use script_alias to map a URL prefix to a CGI directory, combined with directory-based access controls (e.g., mod_auth) protecting the script_alias target path. The vulnerability applies whenever the script_alias target path differs from DocumentRoot + URL prefix."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "26.2.5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "27.3.4.10",
                  "versionStartIncluding": "27.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "28.4.2",
                  "versionStartIncluding": "28.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Igor Morgenstern / Aisle Research"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Konrad Pietrzak"
        }
      ],
      "datePublic": "2026-09-08T13:37:22.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIncorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by \u003ccode\u003edirectory\u003c/code\u003e rules when served via \u003ccode\u003escript_alias\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eWhen \u003ccode\u003escript_alias\u003c/code\u003e maps a URL prefix to a directory outside \u003ccode\u003eDocumentRoot\u003c/code\u003e, \u003ccode\u003emod_auth\u003c/code\u003e evaluates \u003ccode\u003edirectory\u003c/code\u003e-based access controls against the \u003ccode\u003eDocumentRoot\u003c/code\u003e-relative path while \u003ccode\u003emod_cgi\u003c/code\u003e executes the script at the \u003ccode\u003eScriptAlias\u003c/code\u003e-resolved path. This path mismatch allows unauthenticated access to CGI scripts that \u003ccode\u003edirectory\u003c/code\u003e rules were meant to protect.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/inets/src/http_server/mod_alias.erl\u003c/code\u003e, \u003ccode\u003elib/inets/src/http_server/mod_auth.erl\u003c/code\u003e, and \u003ccode\u003elib/inets/src/http_server/mod_cgi.erl\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;17.0 before OTP\u0026nbsp;26.2.5.19, OTP\u0026nbsp;27.3.4.10, and OTP\u0026nbsp;28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP\u0026nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by `directory` rules when served via `script_alias`.\n\nWhen `script_alias` maps a URL prefix to a directory outside `DocumentRoot`, `mod_auth` evaluates `directory`-based access controls against the `DocumentRoot`-relative path while `mod_cgi` executes the script at the `ScriptAlias`-resolved path. This path mismatch allows unauthenticated access to CGI scripts that `directory` rules were meant to protect.\n\nThis vulnerability is associated with program files `lib/inets/src/http_server/mod_alias.erl`, `lib/inets/src/http_server/mod_auth.erl`, and `lib/inets/src/http_server/mod_cgi.erl`.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."
            }
          ],
          "value": "Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.\n\nWhen script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T09:08:02.163Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "GitHub Advisory",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f"
        },
        {
          "name": "EEF CNA record for CVE-2026-28808",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-28808.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-28808",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-28808"
        },
        {
          "name": "Erlang/OTP version ordering",
          "tags": [
            "x_version-scheme"
          ],
          "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
        },
        {
          "name": "Introducing commit 07b8f44 in erlang/otp",
          "tags": [
            "related"
          ],
          "url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"
        },
        {
          "name": "Fix commit 8fc71ac in erlang/otp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688"
        },
        {
          "name": "Fix commit 9dfa0c5 in erlang/otp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cul\u003e\n\u003cli\u003eMove CGI scripts inside \u003ccode\u003eDocumentRoot\u003c/code\u003e and use \u003ccode\u003ealias\u003c/code\u003e instead of \u003ccode\u003escript_alias\u003c/code\u003e to ensure \u003ccode\u003emod_auth\u003c/code\u003e resolves the correct path.\u003c/li\u003e\n\u003cli\u003eApply URL-based access controls at a reverse proxy layer to block unauthenticated access to the \u003ccode\u003escript_alias\u003c/code\u003e URL prefix.\u003c/li\u003e\n\u003cli\u003eRemove \u003ccode\u003emod_cgi\u003c/code\u003e from the httpd modules chain if CGI functionality is not required.\u003c/li\u003e\n\u003c/ul\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "* Move CGI scripts inside `DocumentRoot` and use `alias` instead of `script_alias` to ensure `mod_auth` resolves the correct path.\n* Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the `script_alias` URL prefix.\n* Remove `mod_cgi` from the httpd modules chain if CGI functionality is not required."
            }
          ],
          "value": "* Move CGI scripts inside DocumentRoot and use alias instead of script_alias to ensure mod_auth resolves the correct path.\n* Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the script_alias URL prefix.\n* Remove mod_cgi from the httpd modules chain if CGI functionality is not required."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-28808",
    "datePublished": "2026-04-07T12:28:16.056Z",
    "dateReserved": "2026-03-03T14:40:00.590Z",
    "dateUpdated": "2026-09-22T09:08:02.163Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}