CVE-2026-8046

Summary

The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges.

Affected Software

VendorProductVersion RangeStatus
CODESYSCODESYS Control RTE (SL)3.0.0.0 < 3.5.22.20affected
CODESYSCODESYS Control RTE (for Beckhoff CX) SL3.0.0.0 < 3.5.22.20affected
CODESYSCODESYS Control Win (SL)3.0.0.0 < 3.5.22.20affected
CODESYSCODESYS HMI (SL)3.0.0.0 < 3.5.22.20affected
CODESYSCODESYS Runtime Toolkit3.0.0.0 < 3.5.22.20affected
CODESYSCODESYS Control for BeagleBone SL3.0.0.0 < 4.21.0.0affected
CODESYSCODESYS Control for emPC-A/iMX6 SL3.0.0.0 < 4.21.0.0affected
CODESYSCODESYS Control for IOT2000 SL3.0.0.0 < 4.21.0.0affected
CODESYSCODESYS Control for Linux ARM SL3.0.0.0 < 4.21.0.0affected
CODESYSCODESYS Control for Linux SL3.0.0.0 < 4.21.0.0affected
CODESYSCODESYS Control for PFC100 SL3.0.0.0 < 4.21.0.0affected
CODESYSCODESYS Control for PFC200 SL3.0.0.0 < 4.21.0.0affected
CODESYSCODESYS Control for PLCnext SL3.0.0.0 < 4.21.0.0affected
CODESYSCODESYS Control for Raspberry Pi SL3.0.0.0 < 4.21.0.0affected
CODESYSCODESYS Control for WAGO Touch Panels 600 SL3.0.0.0 < 4.21.0.0affected
CODESYSCODESYS Virtual Control SL3.0.0.0 < 4.21.0.0affected

Weaknesses

  • CWE-863: CWE-863 Incorrect Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References