CVE-2026-57920 Overview
CVE-2026-57920 is an access control bypass vulnerability in Peplink InControl 2 through version 2.14.2, patched in the release dated 2026-06-03. The flaw allows an authenticated attacker to insert a semicolon character into requests targeting /rest/o/{orgId} endpoints to circumvent access-control rules. Successful exploitation grants unauthorized visibility into resources scoped to other organizations managed by the cloud platform. The issue is categorized under [CWE-551] (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization).
Critical Impact
Authenticated attackers can bypass organization-scoped authorization checks on REST endpoints to access sensitive information belonging to other tenants of the InControl 2 management platform.
Affected Products
- Peplink InControl 2, all versions up to and including 2.14.2
- Peplink InControl 2 releases prior to the 2026-06-03 fix
- Deployments exposing the /rest/o/{orgId} REST API surface
Discovery Timeline
- 2026-06-03 - Peplink releases fixed InControl 2 build addressing the semicolon bypass
- 2026-06-26 - CVE-2026-57920 published to the National Vulnerability Database
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-57920
Vulnerability Analysis
Peplink InControl 2 is a cloud-based management platform for Peplink SD-WAN and networking appliances. It exposes a REST API under /rest/o/{orgId} where {orgId} identifies the organization tenant whose resources are being queried. The platform enforces access-control checks intended to restrict callers to their own organization scope.
The vulnerability arises because the authorization layer and the URL parser interpret the request path inconsistently. When a semicolon is embedded in the URL, the access-control component evaluates one representation of the path while the downstream routing or resource handler evaluates another. This mismatch allows an authenticated but unprivileged user to reach organization endpoints they should not access, resulting in cross-tenant information disclosure.
The CVSS vector indicates a scope change and confidentiality-only impact, consistent with an authorization bypass that leaks data belonging to other tenants without altering integrity or availability. EPSS data lists an exploitation probability of 0.213%.
Root Cause
The root cause is improper handling of the semicolon path parameter delimiter. HTTP frameworks vary in how they treat characters such as ; when normalizing paths, matching routes, or applying policy filters. In InControl 2, the pre-authorization filter fails to canonicalize the request path before applying orgId-based rules, so a crafted URL such as /rest/o/123;/foo bypasses the tenant check while still routing to the target resource.
Attack Vector
An attacker authenticates to InControl 2 with any valid low-privileged account. The attacker then issues HTTP requests to /rest/o/{orgId} endpoints, appending a semicolon and additional path segments or parameters that manipulate the authorization decision. Because the attack is network-based and requires only low privileges with no user interaction, it can be automated against the public management console. Technical details are available in the referenced advisory document.
Detection Methods for CVE-2026-57920
Indicators of Compromise
- HTTP requests to /rest/o/ endpoints containing a semicolon (%3B or literal ;) in the path
- Access log entries where a single authenticated session queries multiple orgId values in short succession
- Successful 200 responses to /rest/o/{orgId} requests from accounts not associated with that organization
Detection Strategies
- Parse InControl 2 web access logs for URI patterns matching /rest/o/[0-9]+; and correlate the calling user to the requested organization
- Alert when a user account issues cross-organization API calls that deviate from historical access baselines
- Inspect reverse proxy or WAF logs for semicolon path parameters targeting REST endpoints and block or flag anomalies
Monitoring Recommendations
- Enable verbose audit logging on InControl 2 REST endpoints, including full raw request URIs
- Forward web and application logs to a centralized analytics platform for tenant-boundary anomaly detection
- Review authentication and session telemetry for accounts issuing unusually broad API enumeration
How to Mitigate CVE-2026-57920
Immediate Actions Required
- Upgrade Peplink InControl 2 to the release dated 2026-06-03 or later
- Audit access logs for the previous 90 days for semicolon-containing requests to /rest/o/ endpoints
- Rotate API tokens and session credentials for accounts observed abusing the endpoint pattern
- Restrict management console exposure to trusted networks where operationally feasible
Patch Information
Peplink resolved CVE-2026-57920 in the InControl 2 build released on 2026-06-03. Operators of self-hosted InControl 2 instances should apply the vendor update; users of the Peplink-hosted service receive the fix automatically. Consult the vendor-referenced document for release specifics.
Workarounds
- Deploy a reverse proxy or WAF rule that rejects requests to /rest/o/ when the path segment contains a semicolon or URL-encoded %3B
- Enforce strict URL canonicalization at the ingress layer before requests reach InControl 2
- Limit REST API access to specific source IP ranges pending patch deployment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
