THREAT OPS › Threat News › [NVD] CVE-2026-28808 (CRITICAL 9.8) — Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.
When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based
[NVD] CVE-2026-28808 (CRITICAL 9.8) — Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based
CVE-2026-28808 CVSS: 9.8 CRITICAL Published: 2026-04-07T13:16:46.320
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.
When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative
Indicators of compromise
- CVE-2026-28808cve
- 26.2.5.19ipv4
- 27.3.4.10ipv4
- 9.1.0.6ipv4
- 9.3.2.4ipv4
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-28808