CVE-2026-102248
HighCVSS 7.3Summary
A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5 in an unknown part of the /user/login file of the Login Endpoint component. The manipulation leads to improper authentication. The attack can be initiated remotely and the exploit is publicly available.
Risk Assessment
A remote attacker can bypass authentication mechanisms and gain unauthorized access to user accounts, potentially leading to data breaches.
Recommendation
Update Rebuild to a patched version and strengthen authentication mechanisms, e.g., by implementing multi-factor authentication.
Other vulnerabilities in Rebuild
See all- CVE-2026-102249High
A security flaw has been discovered in REBUILD up to 4.4.11 in unknown code of the /commons/file-editor-save file. Manipulation of the url/fileKey argument results in missing authorization. The attack can be launched remotely and the exploit has been released.
- CVE-2024-25294Critical
An SSRF vulnerability in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload, and URL parameters.
- CVE-2026-71802Medium
A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages, which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.
Original NVD description (English source)
A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS