CVE Catalog
CVE-2026-50214
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.17%
6th percentile - higher than 6% of all known CVEs
Summary
The /v1/Plan service uses a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.
Risk Assessment
An attacker can create unauthorized access plans, leading to uncontrolled network resource usage and potential security policy violations.
Recommendation
Implement per-user or per-role authentication for the /v1/Plan service. Restrict API token access to trusted administrators only.
Original NVD description (English source)
The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.