CVE-2026-18972

CriticalCVSS 9.6

Published: 11/08/2026(UTC)Updated: 11/08/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Summary

An authenticated attacker can spoof another GUI user's identity by sending a request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover from a low-privileged user to administrator.

Risk Assessment

An attacker with low privileges can take over an administrator account, leading to full system and data compromise.

Recommendation

Apply the vendor's patch that fixes the spoofing vulnerability. Additionally, verify user identity using secure authentication mechanisms.

Original NVD description (English source)

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.