Medium
seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization
Type: advisorySources: OSV
A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. Upgrading to version 1.11.11 is able to resolve this issue. The identifier of the patch is 842eec791377ddcbea5cd639bc065eaa4801d656. It is suggested to upgrade the affected component.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-86804
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 01:16 UTC · Revision 1
Source evidence
seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization
core-osv · Original sourcePublished 8 Sept 2026, 19:00 UTC
A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. Upgrading to version 1.11.11 is able to resolve this issue. The identifier of the patch is 842eec791377ddcbea5cd639bc065eaa4801d656. It is suggested to upgrade the affected component.
osv:CVE-2026-86804
Complete source record
{
"id": "3df0aace43843fee85d9bc785fb43d1c0d2540d87ac431846f600f6edc9d77c5",
"url": "https://osv.dev/vulnerability/CVE-2026-86804",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization",
"summary": "A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. Upgrading to version 1.11.11 is able to resolve this issue. The identifier of the patch is 842eec791377ddcbea5cd639bc065eaa4801d656. It is suggested to upgrade the affected component.",
"evidence": "osv:CVE-2026-86804",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-86804",
"aliases": [
"CVE-2026-86804"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/seakee/cpa-manager-plus",
"type": "GIT",
"events": [
{
"introduced": "8800dee8ec632c159cf1c3d6a707796af17ea414"
},
{
"fixed": "842eec791377ddcbea5cd639bc065eaa4801d656"
},
{
"fixed": "ac2bd06bcc5be819ed7a3f98c9ef2617beabdb46"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "1.11.0"
},
{
"last_affected": "1.11.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.1"
},
{
"last_affected": "1.11.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.2"
},
{
"last_affected": "1.11.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.3"
},
{
"last_affected": "1.11.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.4"
},
{
"last_affected": "1.11.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.5"
},
{
"last_affected": "1.11.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.6"
},
{
"last_affected": "1.11.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.7"
},
{
"last_affected": "1.11.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.8"
},
{
"last_affected": "1.11.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.9"
},
{
"last_affected": "1.11.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.11.10"
},
{
"last_affected": "1.11.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"fixed": "842eec791377ddcbea5cd639bc065eaa4801d656"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ac2bd06bcc5be819ed7a3f98c9ef2617beabdb46"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.11.11"
}
]
}
}
],
"versions": [
"1.11.0",
"1.11.1",
"1.11.10",
"1.11.2",
"1.11.3",
"1.11.4",
"1.11.5",
"1.11.6",
"1.11.7",
"1.11.8",
"1.11.9",
"v1.11.10",
"v1.11.9",
"v1.11.8",
"v1.11.7",
"v1.11.6",
"v1.11.5",
"v1.11.4",
"v1.11.3",
"v1.11.2",
"v1.11.1",
"v1.11.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86804.json"
}
}
],
"modified": "2026-10-28T02:30:24.977861387Z",
"provider": "osv",
"references": [
"https://github.com/seakee/CPA-Manager-Plus/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86804.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-86804",
"https://vuldb.com/cve/CVE-2026-86804",
"https://vuldb.com/submit/911036",
"https://vuldb.com/vuln/399810",
"https://github.com/seakee/CPA-Manager-Plus/issues/462",
"https://vuldb.com/vuln/399810/cti",
"https://github.com/seakee/CPA-Manager-Plus/commit/842eec791377ddcbea5cd639bc065eaa4801d656",
"https://github.com/seakee/CPA-Manager-Plus/pull/463",
"https://github.com/seakee/CPA-Manager-Plus/releases/tag/v1.11.11"
],
"provider_metadata": {
"cwe_ids": [
"CWE-266",
"CWE-285"
],
"cna_assigner": "VulDB",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86804.json"
}
},
"related_cves": [
{
"value": "CVE-2026-86804",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 491529,
"published_at": "2026-09-08T19:00:11.84+00:00"
}