CVE-2026-107795
HighCVSS 7.5Summary
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.
Risk Assessment
A low-privileged user can delete or replace the controller's TLS certificate, potentially disrupting secure management access and exposing the organization to interception of management traffic.
Recommendation
Apply available Omada Controller updates that fix the authorization check and restrict accounts with access to the MSP and OpenAPI APIs to the minimum necessary.
Other vulnerabilities in Omada Controller
See all- CVE-2026-108337High
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
- CVE-2026-102298High
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.
- CVE-2026-84941Medium
An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
- CVE-2026-81531Medium
An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker to remotely query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.
Original NVD description (English source)
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS