What is GHSA-h5xf-rv7f-wv3m?

GHSA-h5xf-rv7f-wv3m is a security advisory published by GitHub Security Advisories with High severity. In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0,...

Which CVE IDs does GHSA-h5xf-rv7f-wv3m cover?

GHSA-h5xf-rv7f-wv3m covers the following CVE IDs: CVE-2026-35552. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h5xf-rv7f-wv3m?

GHSA-h5xf-rv7f-wv3m has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-h5xf-rv7f-wv3mHighCVSS 8.1

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0,...

Vendor

GitHub Security Advisories

Published

July 9, 2026

Last Modified

July 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-35552 →

📋 Description

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's license.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-35552
https://caxperts.com
https://github.com/caxperts/security-advisories/blob/main/2026/CAXSEC-2026-001_portal.md
https://github.com/advisories/GHSA-h5xf-rv7f-wv3m