CVE-2026-114361

The record

A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.

Affected packages

Related vulnerabilities

• CVE-2026-54854 Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. CWE-266
• CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. CWE-266
• CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. CWE-266
• CVE-2026-119599 AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows… CWE-266
• CVE-2026-118082 Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. CWE-266
• CVE-2026-118644 n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution… CWE-266
• CVE-2026-116471 A security flaw has been discovered in BKWLD Decoy up to 5.11.1. CWE-266
• CVE-2026-116106 A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. CWE-266