Unrated severityNVD Advisory· Published Jul 8, 2026· Updated Jul 9, 2026

CVE-2026-35552

Description

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's license.

Affected products

CAXPerts/UPVWebServicesllm-create
Range: 2.4.2212.603 - 2.7.6
CAXPerts/UDiTH Portalllm-create
Range: 2026.0.0 - 2026.2.0

Patches

Vulnerability mechanics

References

caxperts.commitre
github.com/caxperts/security-advisories/blob/main/2026/CAXSEC-2026-001_portal.mdmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000