CVE-2026-35552: CAXperts Privilege Escalation Flaw

CVE-2026-35552 Overview

CVE-2026-35552 is a missing authorization vulnerability in CAXperts UPVWebServices and UDiTH Portal. An authenticated remote user can invoke an administrative API endpoint that was intended for privileged users only. The endpoint lacks authorization checks, allowing any authenticated caller to deactivate the application's license. This affects UPVWebServices versions 2.4.2212.603 through 2.7.6 and UDiTH Portal versions 2026.0.0 through 2026.2.0.

Critical Impact
Any authenticated user can deactivate the application license through an unprotected administrative API, causing loss of service availability across dependent engineering workflows.

Affected Products

CAXperts UPVWebServices 2.4.2212.603 through 2.7.6
CAXperts UDiTH Portal 2026.0.0 through 2026.2.0
Dependent CAXperts engineering integrations relying on active license state

Discovery Timeline

2026-07-08 - CVE-2026-35552 published to the National Vulnerability Database
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-35552

Vulnerability Analysis

The vulnerability is a broken access control flaw [CWE-862] in the web API layer of CAXperts UPVWebServices and UDiTH Portal. The affected application exposes an administrative endpoint that performs a license deactivation action. Under normal design, this endpoint should be restricted to accounts with an administrative role. The implementation omits the authorization check after authentication, so the server executes the request based only on session validity.

Any user with valid credentials, regardless of assigned role, can call the endpoint and trigger a state change on the license subsystem. Once the license is deactivated, protected features become unavailable to all users until an administrator restores the license state. The flaw does not require a memory corruption primitive, cryptographic weakness, or complex chain. Exploitation reduces to sending a single crafted HTTP request from a low-privilege session. EPSS data currently indicates a low predicted exploitation probability.

Root Cause

The root cause is a missing server-side authorization check on an administrative route. The application verifies that the caller is authenticated but does not verify that the caller holds an administrative role or permission before executing the license deactivation function. Access control was implicitly assumed at the interface layer rather than enforced at the API layer.

Attack Vector

Exploitation requires a valid authenticated session on UPVWebServices or UDiTH Portal. The attacker sends an HTTP request to the administrative API endpoint responsible for license deactivation. The server processes the request under the attacker's session and marks the license as deactivated. Refer to the GitHub Security Advisory CAXSEC-2026-001 for endpoint specifics and request structure.

Detection Methods for CVE-2026-35552

Indicators of Compromise

HTTP requests to administrative API paths originating from non-administrative user sessions on UPVWebServices or UDiTH Portal.
Sudden transition of the application license state to deactivated without a corresponding administrator action in change management records.
Application errors or user reports indicating loss of licensed functionality across the portal.

Detection Strategies

Enable verbose access logging on UPVWebServices and UDiTH Portal and alert on any calls to administrative endpoints by user identities not assigned an admin role.
Correlate authentication logs with API call logs to identify authenticated but non-privileged accounts invoking privileged routes.
Baseline normal license state transitions and alert on unscheduled deactivation events.

Monitoring Recommendations

Forward web server and application logs to a centralized log platform for retention and query.
Track license status via a periodic health check that queries the license subsystem and alerts on state change.
Monitor for repeated administrative endpoint access attempts across multiple user accounts, which may indicate probing.

How to Mitigate CVE-2026-35552

Immediate Actions Required

Identify all deployments of UPVWebServices in the affected range 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0.
Restrict network access to the portal so only trusted internal users can reach the application while a patch is planned.
Review user accounts and disable or reduce the scope of any accounts not required for current operations.
Audit application and web server logs for prior calls to the administrative license endpoint from non-administrative accounts.

Patch Information

Refer to the vendor advisory at GitHub Security Advisory CAXSEC-2026-001 and the CAXperts main website for the fixed release versions and upgrade instructions. Apply the vendor-provided update to a version outside the affected ranges once available in your environment.

Workarounds

Place the portal behind a reverse proxy or web application firewall and block requests to the administrative license API path from non-administrative source identities.
Reduce the number of authenticated user accounts on the portal to the minimum required until a patched version is deployed.
Isolate the portal on a management network segment reachable only by trusted administrative hosts.

bash

# Example reverse proxy rule to restrict the administrative endpoint
# Replace <admin-endpoint-path> with the path documented in the vendor advisory
location /<admin-endpoint-path> {
    allow 10.0.0.0/24;   # administrator subnet
    deny  all;
    proxy_pass http://upvwebservices_backend;
}