CVE-2026-42098

The record

Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior (e.g. using a debugger) and log in as any other user or administrator - then it is possible to do every possible change to the repository. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 17.1 and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Affected packages

Related vulnerabilities

• CVE-2026-76945 The affected Ebyte device relies on client-managed authentication tokens without… CWE-603
• CVE-2026-71187 The Ebyte device relies on client side authentication logic that can be reproduced by… CWE-603
• CVE-2026-8830 A flaw was found in Keycloak. CWE-603
• CVE-2026-40551 mpGabinet performs client-side authentication. CWE-603
• CVE-2025-30042 The CGM CLININET system provides smart card authentication; however, authentication is… CWE-603
• CVE-2026-1363 IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security… CWE-603
• CVE-2025-64119 A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This… CWE-603
• CVE-2025-12868 New Site Server developed by CyberTutor has a Use of Client-Side Authentication… CWE-603