CVE-2026-7292

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-7292
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7292.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-7292
Published
2026-04-28T17:30:10.503Z
Modified
2026-07-15T01:49:04.508411858Z
Severity
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
o2oa NodeAgent NodeAgent.java syncFile improper authorization
Details

A security vulnerability has been detected in o2oa up to 10.0. This impacts the function syncFile of the file NodeAgent.java of the component NodeAgent. The manipulation leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cwe_ids": [
        "CWE-266",
        "CWE-285"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7292.json"
}
References

Affected packages

Git / github.com/o2oa/o2oa

Affected ranges

Type
GIT
Repo
https://github.com/o2oa/o2oa
Events
Introduced
f8141a71854b0e015959903f71333943e9a963ba
Last affected
f8141a71854b0e015959903f71333943e9a963ba
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "10.0"
        },
        {
            "last_affected": "10.0"
        }
    ]
}

Affected versions

10.*
10.0
develop-10.*
develop-10.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7292.json"