CVE-2026-9508: BioStar 2 Information Disclosure Flaw

CVE-2026-9508 Overview

CVE-2026-9508 is a critical access control vulnerability affecting Suprema BioStar 2 access control software, versions 2.9.3 through 2.9.11. The flaw stems from incorrect permission settings on a critical resource [CWE-732]. When administrators configure the backup file path within the NGINX webroot, the backup ZIP archives become publicly accessible. Unauthenticated attackers with network access can retrieve these files directly through URLs such as http(s)://[server]/download/.... The exposed backups contain highly sensitive data including database contents and configuration material used for server impersonation and lateral movement.

Critical Impact
Unauthenticated network attackers can download backup archives containing database credentials and biometric access control data, enabling server impersonation and lateral movement across the environment.

Affected Products

Suprema BioStar 2 version 2.9.3
Suprema BioStar 2 versions 2.9.4 through 2.9.10
Suprema BioStar 2 version 2.9.11

Discovery Timeline

2026-05-29 - CVE-2026-9508 published to the National Vulnerability Database (NVD)
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-9508

Vulnerability Analysis

The vulnerability resides in how Suprema BioStar 2 handles backup file placement and access control. BioStar 2 ships with an NGINX-based web server that serves the management console. When an administrator selects a backup destination inside the NGINX document root, the application does not enforce server-side access controls on the resulting archives. NGINX then serves these files as static content under the /download/ path. Any client capable of issuing an HTTP GET request can retrieve them without presenting credentials or a session token.

The backup archives contain database dumps with user records, credential material, device configuration, and audit logs. Attackers who obtain these files can extract database connection strings, impersonate the BioStar server toward managed devices, and pivot into adjacent systems referenced in the configuration.

Root Cause

The root cause is improper permission assignment for a critical resource [CWE-732]. The application allows the administrator to designate a backup directory that falls within the NGINX webroot without warning, without applying restrictive file system permissions, and without injecting an NGINX location rule to block direct retrieval. The web server treats the backups as ordinary downloadable assets.

Attack Vector

The attack vector is network-based and requires no authentication, no privileges, and no user interaction. An attacker enumerates the predictable /download/ path on the target BioStar 2 web interface, identifies backup ZIP filenames through directory listings or naming conventions, and issues an HTTP request to retrieve each archive. Because the request never traverses the application authentication layer, no audit entry is generated by the application logic.

No public proof-of-concept code is available for CVE-2026-9508. Refer to the INCIBE Security Notice for additional vendor coordination details.

Detection Methods for CVE-2026-9508

Indicators of Compromise

Unauthenticated HTTP GET requests to /download/ paths in NGINX access.log returning HTTP 200 with large response sizes consistent with ZIP archives.
Requests for files matching backup naming patterns such as *.zip, biostar_backup_*, or timestamped archive names from external IP addresses.
Spikes in outbound bandwidth from the BioStar 2 host correlated with /download/ access entries.

Detection Strategies

Review NGINX access logs for any 200-status responses on /download/ URIs that were not preceded by an authenticated session.
Inspect the configured backup directory and confirm whether it resides under the NGINX webroot, then cross-reference with web server request history.
Compare backup file inventory against logged download events to identify archives that were retrieved over HTTP.

Monitoring Recommendations

Forward NGINX access and error logs to a centralized log platform and alert on anonymous access to backup file extensions.
Monitor for new files appearing in the NGINX document root, especially .zip, .sql, and .bak artifacts.
Track authentication events from BioStar 2 devices to detect server impersonation attempts that may follow archive theft.

How to Mitigate CVE-2026-9508

Immediate Actions Required

Move the backup destination outside of the NGINX webroot to a directory that is not served by the web server.
Rotate database credentials, API keys, and device shared secrets contained in any backup that may have been exposed.
Audit NGINX access logs for prior unauthorized retrieval of backup archives and treat any matches as a confirmed breach.
Apply the vendor update for BioStar 2 once released and validate the configuration after upgrade.

Patch Information

Suprema has been notified through the INCIBE-CERT coordination process. Administrators should consult the INCIBE Security Notice for the latest patched version and apply it to all BioStar 2 deployments running versions 2.9.3 through 2.9.11.

Workarounds

Relocate existing backups to a path outside the NGINX document root and delete any copies still residing under it.
Add an NGINX location block that returns HTTP 403 for the /download/ URI or for the specific backup file extensions in use.
Restrict network access to the BioStar 2 web interface using firewall rules so that only trusted management subnets can reach TCP/443.

bash

# Example NGINX configuration snippet to deny direct backup retrieval
location ~* ^/download/.*\.(zip|sql|bak|tar|gz)$ {
    deny all;
    return 403;
}