CAI Content Credentials | Improper Access Control (CWE-284)

CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

Problem type

Improper Access Control (CWE-284)

Affected products

Adobe

Content Credentials Rust SDK

<= c2pa-v0.90.15 - AFFECTED

c2pa-v0.91.1 - UNAFFECTED

C2PA Tool

<= c2patool-v0.27.15 - AFFECTED

v0.28.1 - UNAFFECTED

Content Credentials JS SDK

<= @contentauth/c2pa-web@0.13.4 - AFFECTED

@contentauth/c2pa-web@0.15.3 - UNAFFECTED

References

adobe.com

https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html

vendor-advisory

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-100114

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-100114",
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "dateUpdated": "2026-10-13T21:27:42.856Z",
    "dateReserved": "2026-09-25T11:19:19.065Z",
    "datePublished": "2026-10-13T21:27:42.856Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe",
        "dateUpdated": "2026-10-13T21:27:42.856Z"
      },
      "datePublic": "2026-10-13T17:00:00.000Z",
      "title": "CAI Content Credentials | Improper Access Control (CWE-284)",
      "descriptions": [
        {
          "lang": "en",
          "value": "CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction."
        }
      ],
      "affected": [
        {
          "vendor": "Adobe",
          "product": "Content Credentials Rust SDK",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "c2pa-v0.90.15"
            },
            {
              "version": "c2pa-v0.91.1",
              "status": "unaffected",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Adobe",
          "product": "C2PA Tool",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "c2patool-v0.27.15"
            },
            {
              "version": "v0.28.1",
              "status": "unaffected",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Adobe",
          "product": "Content Credentials JS SDK",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "@contentauth/c2pa-web@0.13.4"
            },
            {
              "version": "@contentauth/c2pa-web@0.15.3",
              "status": "unaffected",
              "versionType": "custom"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Improper Access Control (CWE-284)",
              "cweId": "CWE-284",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html",
          "tags": [
            "vendor-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ],
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "availabilityRequirement": "NOT_DEFINED",
            "modifiedAttackVector": "NETWORK",
            "modifiedAttackComplexity": "LOW",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedUserInteraction": "NONE",
            "modifiedScope": "UNCHANGED",
            "modifiedConfidentialityImpact": "NONE",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedAvailabilityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH"
          }
        }
      ]
    }
  }
}