Inductive Automation Ignition Software Incorrect Authorization

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-92817",
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "dateUpdated": "2026-10-13T23:22:43.516Z",
    "dateReserved": "2026-09-16T19:57:05.974Z",
    "datePublished": "2026-10-13T23:22:43.516Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert",
        "dateUpdated": "2026-10-13T23:22:43.516Z"
      },
      "title": "Inductive Automation Ignition Software Incorrect Authorization",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.",
          "supportingMedia": [
            {
              "type": "text/html",
              "base64": false,
              "value": "The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process."
            }
          ]
        }
      ],
      "affected": [
        {
          "vendor": "Inductive Automation",
          "product": "Ignition",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.1.0",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "8.1.54"
            },
            {
              "version": "8.1.55",
              "status": "unaffected"
            },
            {
              "version": "8.3.0",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "8.3.8"
            },
            {
              "version": "8.3.9",
              "status": "unaffected"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-863",
              "cweId": "CWE-863",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://security.inductiveautomation.com/?tcuUid=34477620-731d-4b70-b22b-9450f9a659a3"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-01"
        },
        {
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-286-01.json"
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ],
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH"
          }
        },
        {
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Inductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September 2026 to address this issue. Users are recommended to update to the newest version available.\n\n\n\n\n\nFor more information, see the publication at the Inductive Automation Trust Center:  https://security.inductiveautomation.com/?tcuUid=34477620-731d-4b70-b22b-9450f9a659a3",
          "supportingMedia": [
            {
              "type": "text/html",
              "base64": false,
              "value": "<div><p>Inductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September 2026 to address this issue. Users are recommended to update to the newest version available.</p></div><div><p>For more information, see the publication at the Inductive Automation Trust Center:&nbsp;<a href=\"https://security.inductiveautomation.com/?tcuUid=34477620-731d-4b70-b22b-9450f9a659a3\">https://security.inductiveautomation.com/?tcuUid=34477620-731d-4b70-b22b-9450f9a659a3</a>&nbsp;</p>\n</div>"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tim Hemingway reported this vulnerability to Inductive Automation.",
          "type": "finder"
        }
      ]
    }
  }
}