THREAT OPS › Threat News › [NVD] CVE-2026-90448 — A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker
[NVD] CVE-2026-90448 — A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker
CVE-2026-90448 CVSS: None Published: 2026-09-11T22:16:46.950
A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application's own elevated
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-90448cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-90448