{"id":"CVE-2026-95613","aliases":[],"cve":{"records":[{"id":"CVE-2026-95613","source":"Zenitel","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T09:55:19.680Z","published":"2026-11-13T15:44:28.709Z","modified":"2026-11-13T20:04:15.272Z"}],"publishers":[{"name":"Zenitel","role":"CNA","organizationId":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","modified":"2026-11-13T15:44:28.709Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T20:04:15.272Z"}],"references":[{"url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf","tags":[],"source":"Zenitel"}],"weaknesses":[{"id":"CWE-266","description":"CWE-266 Incorrect privilege assignment","source":"Zenitel"},{"id":"CWE-250","description":"CWE-250 Execution with unnecessary privileges","source":"Zenitel"},{"id":"CWE-653","description":"CWE-653 Improper isolation or compartmentalization","source":"Zenitel"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T19:52:39.915721Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim","titleSource":"Zenitel","descriptionSource":"Zenitel","description":"The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the \"postgres\" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.","score":8.6,"severity":"high","published":"2026-11-13T15:44:28.709Z","modified":"2026-11-13T20:04:15.272Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Zenitel","name":"Zenitel Connect","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.11.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Zenitel","url":"https://www.cve.org/CVERecord?id=CVE-2026-95613"}],"remediation":[{"text":"Upgrade to version 1.11.0","source":"Zenitel","url":"https://www.cve.org/CVERecord?id=CVE-2026-95613"}],"references":["https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"],"sources":[{"name":"CVE","id":"CVE-2026-95613","modified":"2026-11-13T20:04:15.272Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95613"}],"assessments":[{"source":"Zenitel","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.6}],"sourceAffected":[],"observedAt":"2026-11-13T20:43:46.448Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:45:30.863Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-13T21:35:55.531Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T21:25:35.198Z","attemptedAt":"2026-11-13T21:25:35.198Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T21:25:35.311Z","attemptedAt":"2026-11-13T21:25:35.311Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T21:25:35.032Z","attemptedAt":"2026-11-13T21:25:35.032Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-ffjc-v396-6wqr","url":"https://github.com/advisories/GHSA-ffjc-v396-6wqr","modified":"2026-11-13T18:32:36Z","checkedAt":"2026-11-13T21:25:35.198Z"},{"source":"ENISA EUVD","id":"EUVD-2026-125523","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125523","modified":"Nov 13, 2026, 8:04:15 PM","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-13T21:25:35.311Z"}],"aiSummary":{"text":"Zenitel Connect firmware before 1.11.0 has a vulnerability where a local attacker with access to the platform CA private key can execute database operations as the PostgreSQL superuser. The pREST API sets the PostgreSQL session role from an unvalidated JWT sub claim. This allows attackers to read sensitive data, including the master encryption key and password hashes.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T23:11:20.425Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95613"}]}}