CVE-2026-119682

The record

An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506.

Affected packages

Related vulnerabilities

• CVE-2026-55147 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
• CVE-2026-55146 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
• CVE-2026-62967 ZTNET is a ZeroTier web UI for private controllers with multiuser and organization… CWE-862
• CVE-2026-62989 Shopper is a Headless e-commerce Admin Panel. CWE-862
• CVE-2026-78403 Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel… CWE-862
• CVE-2026-62301 MyTube is a self-hosted downloader and player for several video websites. CWE-862
• CVE-2026-119337 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. CWE-862
• CVE-2026-116245 libpq looks a connection service up in the service file of the operating-system account… CWE-862