CVE-2026-39515
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Versions of the engine below 1.4.107 have a broken access control issue for subscribers, which may lead to unauthorized access to resources.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data, potentially leading to serious security breaches.
Recommendation
It is recommended to update the engine to version 1.4.107 or later to mitigate this vulnerability.
Other vulnerabilities in Motors
See all- CVE-2026-54828High
Motors versions up to 1.4.109 have a vulnerability in access control that allows unauthorized access.
- CVE-2026-66693Medium
Subscriber-level Broken Access Control vulnerability in Motors plugin versions up to and including 1.4.113.
- CVE-2026-27433Medium
The Motors plugin versions up to 5.6.80 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass security measures and gain unauthorized access to functions or data.
Original NVD description (English source)
Subscriber Broken Access Control in Motors < 1.4.107 versions.