CVE-2026-75108

5.3 mediumEPSS 0.3%

Medium (5.3). EPSS 0.3% chance of exploitation in the next 30 days.

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information including display names, reachability status, connection timing, and network addresses, or trigger wake-on-LAN packets on unauthorized assets.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-08-17
Modified: 2026-09-24
Record from: the NVD, synced 2026-10-19

References

https://github.com/next-terminal/next-terminal
https://github.com/next-terminal/next-terminal/issues/573
https://www.vulncheck.com/advisories/next-terminal-missing-per-asset-authorization-on-portal-endpoints
https://github.com/next-terminal/next-terminal/issues/573

Check your stack JSON