CVE-2026-34024: Wertheim SafeController Auth Bypass Flaw

CVE-2026-34024 Overview

CVE-2026-34024 is a missing authorization vulnerability [CWE-862] in the Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014. The application exposes multiple web endpoints without enforcing proper authorization checks. An authenticated attacker with minimal privileges can reach endpoints hidden from the frontend but directly accessible via crafted HTTP requests. Exploitation allows the attacker to switch the user's branch, upload arbitrary files, download arbitrary files, and view details of arbitrary branches. The flaw breaks tenant and branch isolation in a system that controls physical safe deposit infrastructure.

Critical Impact
A low-privileged authenticated user can bypass branch boundaries, read and write arbitrary files, and access data belonging to other branches across the SafeController deployment.

Affected Products

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014
Deployments referenced in the Wertheim Safe Management Guide
See the SEC Consult Security Advisory for the full affected scope

Discovery Timeline

2026-06-15 - CVE-2026-34024 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-34024

Vulnerability Analysis

The Wertheim SafeController web application enforces access restrictions at the user interface layer rather than at the server endpoint layer. Several backend routes do not appear in the navigation rendered for low-privileged users, but the routes remain active and reachable over HTTP. Because the server fails to verify whether the authenticated session is allowed to invoke each endpoint, any logged-in user can issue requests directly.

The affected endpoints expose four classes of restricted functionality. An attacker can change the active branch context bound to their session, breaking branch-scoped data segregation. The attacker can upload arbitrary files to the server, providing a foothold for persistence or follow-on file write attacks. The attacker can also download arbitrary files, enabling exposure of configuration, audit, or customer records. Finally, the attacker can enumerate details of branches outside their assigned scope.

Root Cause

The root cause is missing authorization [CWE-862] on multiple controllers. The application performs authentication but does not perform per-request authorization checks tied to the user's role or assigned branch. Hiding links in the UI is treated as a security boundary, which is a client-side trust model.

Attack Vector

The attack is network-reachable and requires only valid low-privilege credentials. No user interaction is needed. An attacker enumerates endpoint paths from the application binary, JavaScript bundles, or the public advisory, then submits direct HTTP requests with a valid session cookie. The server executes the requested action without checking entitlement, granting the attacker capabilities normally reserved for administrators or other branches.

No public proof-of-concept code is referenced in the advisory. Technical details are described in the SEC Consult Security Advisory.

Detection Methods for CVE-2026-34024

Indicators of Compromise

Web server access logs showing low-privileged accounts requesting branch-management, file-upload, or file-download endpoints not linked from their assigned UI.
Unexpected branch-switch events in application audit logs for users without multi-branch entitlements.
New or modified files in SafeController upload directories that do not correspond to scheduled administrative activity.
Outbound downloads of configuration files, backups, or branch records initiated by non-administrative sessions.

Detection Strategies

Compare each authenticated HTTP request against the requesting user's assigned role and branch, and alert when the endpoint requires higher privileges.
Baseline normal endpoint usage per user role and flag deviations such as standard users invoking administrative routes.
Correlate session identifiers across branch-switch, upload, and download endpoints within short time windows to surface chained abuse.

Monitoring Recommendations

Enable verbose request logging on the SafeController web tier and forward logs to a central SIEM for retention and search.
Monitor the SafeController file upload directory for new executables, scripts, or archives.
Alert on any HTTP 200 response to branch-administration endpoints when the authenticated principal is not an administrator.

How to Mitigate CVE-2026-34024

Immediate Actions Required

Restrict network access to the SafeController web interface to trusted management networks and VPN ranges only.
Audit all SafeController accounts and disable or reduce privileges for users that do not require interactive access.
Review application and web server logs for prior access to branch-switch, upload, download, and branch-detail endpoints by non-administrative accounts.
Contact Wertheim support to obtain a fixed build superseding AssemblyVersion 6.15.8328.28014.

Patch Information

No fixed version is listed in the NVD entry at publication time. Refer to the SEC Consult Security Advisory and contact Wertheim directly for remediation guidance and a corrected release of SafeController.

Workarounds

Place the SafeController web application behind a reverse proxy or web application firewall and block direct requests to administrative endpoint paths for non-administrator users.
Enforce network segmentation so that only branch-authorized workstations can reach their respective SafeController instances.
Rotate credentials for all SafeController users and require strong, unique passwords with multi-factor authentication where supported.
Disable unused accounts and remove standing access for service accounts that do not require interactive login.

bash

# Configuration example: reverse proxy rule restricting admin endpoints by source IP
# (adapt paths to match those identified in the SEC Consult advisory)
location ~* ^/(BranchSwitch|UploadFile|DownloadFile|BranchDetails) {
    allow 10.10.0.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://safecontroller_backend;
}