CVE-2026-35552: CAXperts Authorization Bypass Allows License Deactivation

Technical summary

The vulnerability stems from insufficient authorization controls on an administrative API endpoint in both UPVWebServices and UDiTH Portal. The endpoint performs license deactivation but fails to validate that the caller holds the necessary privileges. An authenticated remote user can invoke this endpoint directly, bypassing role-based access restrictions. The CVSS 3.1 score of 8.1 (HIGH) reflects the network-accessible nature, low complexity, and the integrity and confidentiality impact of losing application control. Because the attack requires prior authentication, the privilege requirement prevents stranger exploitation, but any internal user, compromised service account, or contractor with basic access becomes a threat vector.

Business impact

License deactivation is a availability attack with secondary integrity implications. Once a license is disabled, the application typically becomes non-functional, halting dependent business processes. For organizations relying on CAXperts' tools for document processing or portal services, this can mean immediate operational shutdown. There is no clear self-healing mechanism; remediation requires administrative intervention or license re-activation, both of which involve downtime and potential escalation. In multi-tenant or SaaS scenarios, a single compromised account could affect multiple customers.

Affected systems

CAXperts UPVWebServices versions 2.4.2212.603 through 2.7.6 and UDiTH Portal versions 2026.0.0 through 2026.2.0 are in scope. Organizations should inventory all deployed instances of these products and their version numbers. Versions outside these ranges may not be vulnerable, but verify against the vendor advisory to confirm your specific release status.

Exploitability

Exploitability is moderate to high in operational environments. An attacker must first obtain valid credentials—either through credential theft, social engineering, or insider activity. Once authenticated, the attack is trivial: a single API call with no additional complexity. The lack of require user interaction (no phishing confirmation, no multi-step exploitation) means that an attacker with access can act immediately and, if not monitored, repeatedly. However, the requirement for initial authentication does limit the attack surface to users with at least basic system access.

Remediation

CAXperts has released patched versions that restore proper authorization checks on the affected endpoint. Upgrade UPVWebServices to version 2.7.7 or later and UDiTH Portal to version 2026.3.0 or later (verify these against the official CAXperts security advisory). If immediate patching is not feasible, implement network-level controls: restrict API endpoint access to trusted administrative networks, enforce network segmentation, and monitor authentication logs for suspicious account activity. Consider implementing additional identity controls such as multi-factor authentication to reduce the risk of credential compromise.

Patch guidance

Obtain the latest patched versions directly from CAXperts support or the official vendor portal. Test patches in a non-production environment first to ensure compatibility with your deployment. Plan a phased rollout: apply patches to development and test systems before moving to production. Monitor application logs and license status during and after patching. Document the patch date and version applied for compliance and audit purposes. If patches are not yet available from the vendor, request an estimated timeline and implement compensating controls.

Detection guidance

Monitor API logs for calls to the license deactivation endpoint, especially from non-administrative user accounts or IP ranges outside your trusted administrative subnets. Look for repeated or failed calls to this endpoint, which may indicate probing activity. Implement alerting on license status changes—any unexpected deactivation should trigger an incident review. Review authentication logs for unusual account activity, particularly for service accounts and users with minimal privileges making administrative API calls. Search historical logs for signs of past exploitation.

Why prioritize this

This vulnerability scores HIGH (8.1) and should be addressed with urgency, though not necessarily as a critical emergency. The requirement for prior authentication lowers the attack surface compared to unauthenticated exploits, but the ease of exploitation once credentials are available and the availability impact justify rapid remediation. Organizations in highly regulated industries or those with strong compliance obligations should prioritize patching. Focus first on internet-facing or multi-tenant instances where credential compromise is more probable.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: network accessibility (AV:N) lowers the barrier to reaching the vulnerability; low attack complexity (AC:L) means no special conditions are needed once inside; the requirement for low privilege credentials (PR:L) acknowledges that authentication is needed; no user interaction (UI:N) makes exploitation automatic; and integrity and confidentiality impact (I:H, C:H) reflect the ability to disable service and potentially access or modify application state. The absence of scope change (S:U) indicates localized impact. The score appropriately places this as HIGH-severity but not critical, pending real-world exploit prevalence.

Frequently asked questions