CVE-2026-77393
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Inductive Automation | Ignition | 0 <= 8.1.53 | affected |
| Inductive Automation | Ignition | 8.1.54 | unaffected |
Weaknesses
- CWE-276: CWE-276
References
- https://security.inductiveautomation.com/?tcuUid=34477620-731d-4b70-b22b-9450f9a659a3
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-06
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-06.json
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.